Google Analytics Joint Controllership Agreement

If website operators integrate the Facebook „Like“ button as a plug-in in the source code of their website and this plug-in then transmits the data of website users to Facebook and Facebook processes this data for its own purposes, the website operators are jointly responsible with Facebook for compliance with European data protection legislation. In any case, if and to the extent that user data has been collected via this plug-in and transmitted to Facebook, the website operators are jointly and severally liable with Facebook in the event of a data protection breach. We recommend that website operators who use Google Analytics carefully check whether their use of the tool meets the requirements formulated by the DSK. In particular, the conclusion of a joint liability contract (which, as far as can be judged, is not currently offered by Google as standard) may prove more difficult in practice. These terms and conditions supplement the agreement. If the Agreement was entered into offline with Google Ireland Limited, these Terms supersede the „Privacy Clause“ of this Agreement (if any). Cooperation must be made transparent to the person concerned. The type of information that must be provided as „first-level information“ in accordance with Article 26(2)(2) of the GDPR must be decided on a case-by-case basis. Regular reference to shared responsibility is required as soon as the data is collected, as well as an indication that additional information can be accessed in an area managed by both parties. CJEU shortens Facebook`s „Like“ button: Website and app operators are „jointly responsible“ with Facebook The CJEU says that even in the case of joint data processing, each individual controller must have its own legal basis. If this „joint responsibility“ is based on the balancing clause in Article 6(1)(1)(f) GDPR, the balancing of interests must also be carried out separately for each controller. The customer who accepts these terms („Customer“), and Google LLC, Google Ireland Limited, Google Asia Pacific Pte. Ltd.

or any other entity controlled directly or indirectly, controlled by Google LLC (if any, „Google“) or under common control with Google LLC, has entered into an agreement in which Google has agreed to provide the Google Cloud Platform Customer (as described in cloud.google.com/terms/services) and associated technical support (as amended, the „Agreement“). On 12 September, the German Conference on Data Protection (`the DSK`) adopted a resolution calling for the German Conference on Data Protection (`the DSK`). May 2020 Guidelines for the Use of Google Analytics in the Non-Public Sector (the „Guidelines“). In particular, the Guidelines state that Google Analytics has adapted the scope of its services over the years and, in its current form, can no longer be considered as a data processor, but as a data controller or a joint data controller. In addition, the Guidelines refute Google Analytics` assertion that the data collected by Google does not allow the identification of individuals and therefore reaffirm that such data is considered personal data within the meaning of Article 4(1) of the GDPR. Therefore, the guidelines stipulate that website providers using Google Analytics must obtain voluntary, informed and positive consent from the user to the use of Google Analytics, which can also be easily revoked, and in addition, provide a clear privacy policy, comply with the principle of transparency and take advantage of the possibility of shortening IP addresses. Google believes that there is no shared responsibility and proposes to conclude a data processing agreement and an agreement in which both parties are individually responsible. This contradicts the opinion of the German data protection authorities. Website owners who enter into these agreements run the risk of coming into conflict with the competent supervisory authority. Entering into an individual agreement with Google in accordance with Article 26 of the GDPR would be a better option. 10.3 Data Center Information. For more information on the location of Google installations, please see: cloud.google.com/about/locations/ (which may be updated by Google from time to time).

The DSK goes on to state that, according to the German authorities, the use of Google Analytics should not be classified as `processing by a processor on behalf of a controller`, but as a joint responsibility of Google and the individual operator of the website. Therefore, according to DSK, no contract for processing by a processor on behalf of a controller (Art. 28 GDPR) is required (as currently offered by Google by default), but a joint liability contract (Art. 26 GDPR). In the 12. Guidelines adopted in May 2020, the supervisory authorities not only jointly reaffirm the view recently communicated by the individual authorities that the use of Google Analytics in the default settings should in principle only be allowed on the basis of the informed, voluntary, active and prior consent of users. The Data Protection Authority concludes that, taking into account European case law (CJEU, judgment of 29.07.2019, Az: C-40/17), the default setting recommended by Google is therefore considered a joint liability in accordance with Art. .

. .