Google Analytics anonymizes and aggregates all user data so it is not possible to look up an individual user. Does that mean that in the event that we use Google Analytics and receive a Subject Access Request, the data that Google Analytics collects is not applicable to the request, or do we still need to find a way to dig any relevant data out of Google Analytics. I also asked about this on SO in case you want to see the technical programmatic version of the question:
Please note that Google Analytics do not anonymize the data you collect on its behalf unless you configure it to do IP-anonymization.
If you use Google Analytics and do not use this feature, you need to have a DPA (Data Processing Addendum) in place with Google in order to comply with the GDPR.
This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization. According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics.
Does data that is anonymized need to be collect in the event of a GDPR Subject Access Request?
No. But as the controller, you need to make sure that is is anonymized.