The French data protection agency (CNIL) ruled that the use of Google Analytics by French website operators resulted in the transfer of personal data to the US in the absence of any sufficient safeguards, violating Chapter V of the GDPR in light of the Schrems II Case.

The CNIL has explained that merely having in place standard contractual clauses with Google is insufficient to meet the requirements of the GDPR; there must be additional legal, organizational, and technical measures required.

Further, the CNIL explained they believe certain security solutions to be ineffective, such as adjusting configuration settings in the Google Analytics tool and encryption, while highlighting potentially effective solutions such as certain proxy server use and EU based audience measurement solutions.

Federal and provincial privacy authorities concluded in their investigation of Tim Horton’s app that Tim Horton’s continual and vast collection of user’s location information, even while the app was not open, violated Canadian privacy laws.

The app misled users to believe the permission given for access to the mobile device’s geolocation features would only be accessed when the app was in use, while that data was collected so long as the device was on.