The InterHop association, which specializes in free software, rails against the processing of data collected by the Google Analytics solution, hosted in the United States.
Are we witnessing an outcry against the Google Analytics website audience measurement solution in Europe? InterHop wants to be the French representative of the movement. The French association, which develops and offers free and open source software for health, announces that it has seized the National Commission for Computing and Liberties (CNIL), in order to ” stop processing that proves to be illegal “. Here, it is targeting Google in particular, which hosts the data of e-health players from its Analytics solution directly in the United States.
Case law much less favorable to the transfer of data outside the EU
On January 13, 2022, the Datenschutzbehörde, the Austrian CNIL, issued a decision in which it rules against the legality of the use of Google Analytics, which it believes does not comply with the GDPR. Some companies have therefore announced in the process to prohibit, internally, the use of the tool of the Mountain View firm.
This decision echoes other recent events, with in the first place, the famous Schrems II judgment, delivered on July 16, 2020 and by which the Court of Justice of the European Union (CJEU) came to invalidate a previous agreement, the Privacy Shield, which allowed the transfer of personal data to a country outside the European Union, here the United States. In other words: the transfer of personal data to the USA is no longer qualified as secure. Two American texts are in the sights of the European authorities and the French CNIL: the Foreign Intelligence Surveillance Act (FISA), which makes it possible to target people located outside the United States and theExecutive Order, which legalizes techniques for interception of signals from or to the USA. An interference denounced by data protection activists. Microsoft is, for example, subject to requests from the American State, which may oblige it to transfer data that it hosts at any time, in particular when security reasons are invoked.
The decision taken by the Austrian CNIL a few days ago points the finger at Google (without however condemning the company), which admitted to hosting (therefore storing and then further processing) all the data collected by Analytics in the United States. For the famous data protection activist, Max Schrems, this is illegal, contrary to the GDPR. The president of noyb.eu criticizes many European companies for having followed suit, rather than turning to legal options. It was obviously enough to make other associations react.
Several French e-health players singled out by InterHop for their use of Analytics
InterHop, which sticks to the field of health, indicates that many French e-health companies use the Google Analytics service. She cites in particular Maiia, KelDoc, HelloCare, Alan, Recare, Qare, Medadom, Implicity, Therapixel. The association maintains that Recare even mentions, on its website, that data can be ” processed outside of the EEA, including in the United States of America. We have entered into EU standard contractual clauses with the service provider to ensure an adequate level of data protection “.
The InterHop association asserts that players in the world of e-health ” must ensure that they are not subject, in whole or in part, to injunctions from third-party jurisdictions or administrative authorities obliging them to transfer data to them “. As such, it seized the CNIL.
Recalling firstly that health data are ” sensitive data », InterHop asks the CNIL to stop the processing which would prove to be illegal, by analyzing the consequences of the Schrems II judgment on the use of Google Analytics concerning e-health players.
The Covid-19 epidemic has brought telemedicine into the daily life of the French. Before confinement, teleconsultations were limited to a few thousand per week throughout the territory – they were several million during the crisis.
Read more
Sources: InterHop
, noyb
0