Hopp til hovedinnhold

Tips noen om denne nettsiden

* Du må skrive inn 2 gyldige e-postadresser * Ugyldige felter er fylt ut, mail sendes ikke.
Ditt tips er sendt
Det oppstod en uventet feil. Vennligst forsøk på nytt senere

Considers use of Google Analytics to be illegal

The use of the analysis tool Google Analytics by the Norwegian Tax Administration and the Norwegian State Educational Loan Fund is in violation of the legislation relating to data protection.

The agencies are not in control of how Google uses the information on visitors to their websites.

In 2011, the Norwegian Data Protection Authority reviewed the use of Google Analytics by the Tax Administration and the State Educational Loan Fund. In the preliminary inspection reports, the Data Protection Authority concluded that agencies' use of the analysis tool is not in accordance with Norwegian law. The Data Protection Authority has now informed the agencies that they must document that the information collected is anonymised and used only for statistical purposes. The agencies are granted an opportunity to reply before the Data Protection Authority will make the final decision.

Google Analytics is a free analysis tool used by the Tax Administration, the State Educational Loan Fund and many other public and private enterprises for their websites. This and similar analysis tools collect IP addresses which yield information on the behaviour of the visitors to the websites. The purpose of the analysis tool in this context is to obtain knowledge regarding the needs of the visitors to facilitate design of an optimum website in terms of user-friendliness and functionality. Not in control

The Data Protection Authority is of the pinion that the State Educational Loan Fund and the Tax Administration are not in control of how the IP addresses are processed because they have accepted the terms and conditions for use of Google Analytics without any reservations.

"When enterprises accept the terms, they also grant Google access to personal information regarding the visitors to the websites. As a consequence, they are no longer in control of the information collected", says Bjørn Erik Thon, Director at the Data Protection Authority. 

In the Terms of Service, for example, Google states that it may use the IP addresses to provide other services in connection with the activity on the website and use of the Internet. This means that the company may compile information on the visitors from many different websites, including in the past. If the user uses Google's logon services, Google will also be able to identify the user. 

The agencies are responsible

When IP addresses are collected via the websites of the Tax Administration and the State Educational Loan Fund, they are sent to Google for processing of the information. The Data Protection Authority considers Google to function as a processor for the agencies, i.e. a supplier providing services on behalf of the responsible enterprises. 

"As the parties responsible for the websites, the Tax Administration and the State Educational Loan Fund must establish applicable requirements for Google's function as a service provider. The agencies are fully responsible for ensuring that the supplier processes the information in accordance with Norwegian law," says Thon. 

The Data Protection Authority now requests that the State Educational Loan Fund and the Tax Administration document that the IP addresses collected are anonymised and that the information is used only for the sake of analysis.

The Data Protection Authority also requires that the information provided to the visitors regarding collection and anonymisation of IP addresses on the agencies' websites be correct.

The deadline for a reply to the notice and preliminary inspection report from the Data Protection Authority is 1 October 2012.

Til toppen