France: First CNIL ruling on illegality of data transfers to US via Google Analytics

On 10 February 2022, the Commission nationale de l'informatique et des libertés (CNIL), the French data protection agency, issued a decision with regards to Google Analytics's data transfer to the United States compliance with the General Data Protection Regulation (GDPR). CNIL found that Google Analytics had not taken the sufficient additional safeguard required by Art.44 of the GDPR for data transfers to third countries. Specifically, the measures taken by Google Analytics remained insufficient to prevent US intelligence services from accessing transferred data. CNIL has ordered a number of websites using Google Analytics to cease using the service or to use a service that does not involve data transfers outside the EU, giving them a one-month deadline for compliance.