- Subject: Illegitimate use of Google Analytics: removal request following GDPR art. 17
- Dear Data Owner, Dear Data Protection Officer,
- I am writing to you as a user of the xxxxxxx.it website to request the removal of my personal data, following to art. 17 ("Right to cancellation") of EU regulation 2016/679. Please respond within 31 days of receiving this letter to confirm compliance, as detailed below.
- Your site incorporates Google Analytics, which transfers the personal data of all your visitors to Google in the USA. With the legal provision of 9 June 2022 (9782890), this was declared illegitimate by the Authority for the protection of personal data, as announced in the press release "Google: Data Protection Authority stop the use of Analytics. Data transferred to the USA without adequate guarantees".
- Guido Scorza, member of the Authority, further illustrated the provision in the interview with Matteo Flora "Google Analytics prohibited - let's analyze the problem". The use of Google Analytics is also illegitimate as any legitimate purpose can be satisfied by free software hosted in the EU and suitable for the correct processing of personal data, such as Matomo, Plausible Analytics or others recommended by the French CNIL Authority, while no version o configuration of Google Analytics can guarantee not to process personal data unlawfully.
- In light of the above:
- 1) I specify that the personal data subject of this request are those deriving from my visit to your site in recent days, identifiable by my IP address (51.158.x.y) and user-agent ("Mozilla / 5.0 (X11; Linux x86_64) AppleWebKit /537.36 (KHTML, like Gecko) Chrome / 76.0.3803.0 Safari / 537.36 "), and any data connected or deriving from them;
- 2) I request the deletion of such personal data from the information systems of your data controller and from any backups and wherever they have been transmitted due to your use of Google Analytics, as: a) such processing is unlawful and b) such personal data they are not necessary for any legitimate purposes, as described above; c) to the extent that the processing could possibly be lawful by virtue of my consent, I deny having given my informed and valid consent, which in any case I expressly revoke with this; d) if the data were allegedly processed on the basis of a legitimate interest, this takes the value of opposition to the processing as well as a request for cancellation;
- 3) in particular, I request the removal of any register or copy of the aforementioned personal data by Google and any other person in charge of such processing or other person who has received them, including all data sent by my browser at the time of the visit, as well as any pseudonymized version of the same and any aggregate data attributable to the same or to my other personal data, such as the classification in cohorts or any type of unique identifier;
- 4) I also request, pursuant to art. 18 (1) (d) of regulation 2016/679, to immediately stop any processing of such personal data connected to my past and future use of your site, for example by providing for the complete removal from it of Google Analytics (in any version and configuration ) and stopping any use of the data produced by Google in relation to the users of your site;
- 5) if you deem it necessary, I declare myself available to provide further data useful to identify me as the person to whom the above personal data refer, such as the exact IP address and the date and time of the most recent visit, as well as cookies and other identifiers displayed by Google in correspondence with the same;
- 6) I request to respond to the above primarily through the form linked below, provided through free software LimeSurvey hosted in the EU (and respectful of privacy), within 31 days of receiving this; my email address for this matter is firstname.lastname@example.org.
- In faith,
- Federico Leva
- Helsinki, 1 July 2022
- Reply form:
- Correction or removal of the e-mail address:
RAW Paste Data Copied