The agencies are not in control of how Google uses the information on visitors to their websites.
In 2011, the Norwegian Data Protection Authority reviewed the use of Google Analytics by the Tax Administration and the State Educational Loan Fund. In the preliminary inspection reports, the Data Protection Authority concluded that agencies' use of the analysis tool is not in accordance with Norwegian law. The Data Protection Authority has now informed the agencies that they must document that the information collected is anonymised and used only for statistical purposes. The agencies are granted an opportunity to reply before the Data Protection Authority will make the final decision.
The Data Protection Authority is of the pinion that the State Educational Loan Fund and the Tax Administration are not in control of how the IP addresses are processed because they have accepted the terms and conditions for use of Google Analytics without any reservations.
"When enterprises accept the terms, they also grant Google access to personal information regarding the visitors to the websites. As a consequence, they are no longer in control of the information collected", says Bjørn Erik Thon, Director at the Data Protection Authority.
In the Terms of Service, for example, Google states that it may use the IP addresses to provide other services in connection with the activity on the website and use of the Internet. This means that the company may compile information on the visitors from many different websites, including in the past. If the user uses Google's logon services, Google will also be able to identify the user.
The agencies are responsible
When IP addresses are collected via the websites of the Tax Administration and the State Educational Loan Fund, they are sent to Google for processing of the information. The Data Protection Authority considers Google to function as a processor for the agencies, i.e. a supplier providing services on behalf of the responsible enterprises.
"As the parties responsible for the websites, the Tax Administration and the State Educational Loan Fund must establish applicable requirements for Google's function as a service provider. The agencies are fully responsible for ensuring that the supplier processes the information in accordance with Norwegian law," says Thon.
The Data Protection Authority now requests that the State Educational Loan Fund and the Tax Administration document that the IP addresses collected are anonymised and that the information is used only for the sake of analysis.
The Data Protection Authority also requires that the information provided to the visitors regarding collection and anonymisation of IP addresses on the agencies' websites be correct.
The deadline for a reply to the notice and preliminary inspection report from the Data Protection Authority is 1 October 2012.