When using Google Analytics and receiving a GDPR subject access request does the party receiving the request also have to send all data collected by Google Analytics?
2 Answers
Yes, it would be too obvious a loophole otherwise. You'd just put a shell company in front of the actual business, and have that shell company claim it didn't hold onto any data.
Formally, you are the Data Controller, and Google is a Data Processor. You must have a contract in place with Google that guarantees you can abide by GDPR obligations.
Just to add to the (correct) answer already given by @MSalters.
You can escape this obligation by not letting Google Analytics process personal data on your behalf.
You can do this by enabling the GA IP-anonymization feature.
If you use Google Analytics and do not use this feature, you need to have a DPA (Data Processing Addendum) contract in place with Google in order to comply with the GDPR.
This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization. According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics.
-
1
-
Please note that enabling IP anonymization will not necessarily make your data anonymous, as Google usually stores user IDs associated with events (either auto-generated ones stored in cookies or an ID that you provide to Google), so the data is at best pseudonymous. Why? Given such a user ID you can extract data related to a specific person from GA, hence the data is not anomymous. Commented Dec 18, 2019 at 13:52