In his current activity report for the year 2019 (pdf, German, p. 126), the Data Protection Commissioner from Hamburg (“DPA”) also deals with the topic "Google Analytics". In his view, he believes that it is not possible to make data anonymous and thus exclude the scope of the GDPR simply by shortening the IP address, given that this is just one of many usage data.

According to the authority, the tool serves not only the benefit for the website operator in the form of statistics, but also the acquisition of information by Google.

In the standard setting objected to by the DPA and recommended by Google to the website operators, data processing agreement pursuant to Art. 28 GDPR is to be concluded between Google LLC and the website operator. Furthermore, if the standard setting is selected, the website operator is also required to conclude a "controller-controller agreement", from which it follows that both Google and the website operator act under their own responsibility and reserve the possibility of processing the data in other ways. In the opinion of the authority, however, such a splitting up of processing operations is unrealistic.

The DPA's criticism is aimed at the fact that the technical process triggered by Google Analytics in the context of the user's visit to the website, which simultaneously collects data for the website operator itself and transfers them to Google, is a single life event. A "rise" from processor to a data controller within a processing activity is unknown to the legal understanding of the roles of the GDPR.

The DPA comes to the conclusion that, taking into account European case law (ECJ, judgment of 29.07.2019, Ref: C-40/17), the default setting recommended by Google must therefore be assumed to be a joint controllership pursuant to Art. 26 GDPR.

Criticism

I would not share the view of the authority that the splitting of processing operations according to different purposes of use and different roles of responsibility, is alien to life. In my view, the purpose for which data are to be processed is always important. Of course, it is possible that I carry out data processing for a specific purpose (here: creation of statistical analyses) as a processor on behalf of others, and in addition, for another (autonomous) purpose, carry out further processing of the data. The Art. 29 Working Party has already stated in its WP 169 (pdf, p. 30): "In other words, the same entity may act at the same time as a controller for certain processing operations and as a processor for others, and the qualification as controller or processor has to be assessed with regard to specific sets of data or operations".



