“Dutch municipalities unknowingly send data to the United States”

Dutch municipalities are running on hot coals, but the Dutch Data Protection Authority has no reason to intervene.

Several municipalities unknowingly send personal data to the United States. This emerges from to research from AG Connect, National Governance and iGovernment.

Around two out of five municipalities work with Analytics, while it is unclear whether website visitor data is anonymised. This is required by law. Analytics is not illegal by definition, but users should know how the software works.

The problem with Analytics

The most popular version of Analytics is called Universal Analytics. Universal Analytics’ default settings ensure that the IP addresses of website visitors are stored. Google processes Analytics data in US data centers. US law stipulates that intelligence agencies must have access to data stored in the United States.

If a Dutch company uses the standard parameters of Universal Analytics, US intelligence services can trace the identity of visitors. This is prohibited by the AVG/GDPR. European personal data should stay in Europe. National privacy authorities monitor this, including the Dutch Data Protection Authority.

The authorities are struggling to deal with the United States and Google. Small and medium-sized businesses are an easier target. Thus, organizations of AustriaItaly and France been prosecuted in recent months for using Analytics.

Google is currently removing Universal Analytics. From October 1, 2023 the software is no longer functional. The default settings for the new version, Google Analytics 4, do not store IP addresses. A user will have to explicitly verify the feature to be punishable in Europe.

The problem of municipalities

About two out of five Dutch municipalities use Analytics. It’s not necessarily illegal. Users can change the default settings to anonymize IP addresses, rendering the information useless to US authorities. Additionally, data sharing can be manually disabled. From this moment the software is AVG/GDPR compliant.

The problem is that users, including municipalities, rarely specify how their Analytics environment works. Companies and governments are required to explain what happens to visitor data. If you don’t, you risk a fine from the Dutch Data Protection Authority. Only two of the fifty municipalities surveyed are transparent about the use of Analytics.

Although privacy authorities in Austria, Italy and France have recently taken action against Analytics users, the Dutch Data Protection Authority remains neutral. In April 2022, the authority published a guide to privacy-friendly Analytics settings† In May 2022, the authority investigated the use of Analytics on several websites. At the time it was “too early to say anything about sanctions”†

The law is clear, the application is not

It is obvious that European users can be sanctioned, including Dutch municipalities. The likelihood that the Dutch data protection authority will act, on the other hand, is low.

Not all privacy breaches have the same impact. It is true that American intelligence services can access European personal data via Analytics, but the average Dutchman does not lose sleep over it. There are hotter fires, including the tax blacklist and the national government security policy† The Dutch Data Protection Authority works with limited resources. The executor focuses on the most urgent situations.

Moreover, the source of the problem is already treated. The European Union and the United States are currently working on a agreement on data transfers between the EU and the United States† Soon, cloud providers like Google will be able to exchange personal data between the EU and the US without violating the laws of either continent.

Trick: A weak policy causes a cyberattack on the commune of Buren