Sweden's privacy watchdog fines companies over $1M for Google Analytics breaches

Sweden's privacy watchdog, the Swedish Data Protection Authority (IMY), has issued fines totaling over $1.1 million to Swedish telco Tele2 and online retailer CDON for violations related to the use of Google Analytics.

The fines come as a result of strategic privacy complaints filed in August 2020, targeting Google Analytics and Facebook Connect. IMY found that the additional measures taken by Google to protect European user data sent to the U.S. for processing were insufficient to meet the required legal standard.

The watchdog specifically highlighted Google's use of IP address truncation, stating that Tele2 failed to clarify whether the truncation occurred before or after data transfer to the US, thereby failing to demonstrate adequate protection. Additionally, IMY found breaches of the General Data Protection Regulation (GDPR) rules on data transfers to third countries in the cases of Coop and Dagens Industries, but did not impose fines on them.

IMY considers the data transferred to the US through Google Analytics as personal data that can be linked to other unique data, and it concluded that the technical security measures taken by the companies were inadequate to ensure a level of protection equivalent to that guaranteed within the EU/EEA. As a result, IMY fined Tele2 12 million SEK and CDON 300,000 SEK, while ordering Coop and Dagens Industries to cease using the tool.

Last year, several other European Union Data Protection Authorities (DPAs) issued warnings regarding the use of Google Analytics after finding non-compliance with EU rules on international data transfers. However, financial sanctions were not imposed by these regulators, signaling a softer approach to enforcement.

Google responded by stating that organizations using Google Analytics have control over the data collected and how it is used, and that Google provides safeguards, controls, and resources for compliance.