1

Google Analytics anonymizes and aggregates all user data so it is not possible to look up an individual user. Does that mean that in the event that we use Google Analytics and receive a Subject Access Request, the data that Google Analytics collects is not applicable to the request, or do we still need to find a way to dig any relevant data out of Google Analytics. I also asked about this on SO in case you want to see the technical programmatic version of the question:

https://stackoverflow.com/questions/50684479/handling-gdpr-subject-access-request-for-google-analytics/50703855#50703855

Improve this question
1
  • Google Analytics anonymizes and aggregates all user data - only if you set anonymizeIp
    – wimh
    Jun 5, 2018 at 15:55

1 Answer 1

Reset to default
4

Please note that Google Analytics do not anonymize the data you collect on its behalf unless you configure it to do IP-anonymization.

If you use Google Analytics and do not use this feature, you need to have a DPA (Data Processing Addendum) in place with Google in order to comply with the GDPR.

This is a real hassle, so unless you absolutely need fine-grained demographic data, it is strongly recommended that you use IP-anonymization. According to our data protection supervisory authority, this is sufficient to comply with the GDPR vis-a-vis Google Analytics.

Does data that is anonymized need to be collect in the event of a GDPR Subject Access Request?

No. But as the controller, you need to make sure that is is anonymized.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .