gdpr data-protection
What is the correct responce of a data processor to a SAR if they have multiple controllers?
<p>In the case where a subjects data handled both by a data controller and a data processor, and the subject makes a data subject access request (SAR) of the processor the usual procedure if for the data processor to pass the SAR to the data controller, and the data controller to provide the requested information.</p>
<p>Google analytics is used by many sites (<a href="https://martech.org/as-google-analytics-turns-10-we-ask-how-many-websites-use-it/" rel="nofollow noreferrer">in 2015 BuiltWith said</a> it was 29.3 million), and <a href="https://support.google.com/analytics/answer/9024351" rel="nofollow noreferrer">claim to be a data processor</a>:</p>
<blockquote>
<p>Google Analytics and Google Analytics for Firebase remain processors for Analytics data that is not shared and used under this setting.</p>
</blockquote>
<p>If one made a SAR to google analytics, what would be the appropriate response?</p>

<p>Indeed, Google acts as a data processor for its cloud products like Analytics. A data processor has <strong>no obligation</strong> and <strong>no right</strong> to fulfill a DSAR. It can be argued that the processor should forward the request to the correct controller, but the opposite can be argued as well.</p>
<p>If you submit a DSAR to Google Analytics as a whole then you cannot get any meaningful response, for technical and legal reasons.</p>
<ul>
<li><p>To figure out which data controllers might hold data about you, Google would have to search their customer's database for information about you. But performing such a search would break their duties as a data processor.</p>
</li>
<li><p>Google Analytics is designed in such a manner that there is no cross-site user identifier, so Google wouldn't be able to tell which customers hold data about you even if it wanted to.</p>
</li>
</ul>
<p>In contrast, if you were to submit a DSAR to Google about all Analytics data that relates to a website <code>example.com</code>, then it could be argued more reasonably that Google should forward the request to the <code>example.com</code> data controller. In practice, I think Google would decline to do this unless ordered to do so by a court.</p>
<p>That a data processor <em>might</em> have any obligation to forward a DSAR might be derived from Art 28(3)(e) GDPR:</p>
<blockquote>
<p>That [data processing agreement] shall stipulate, in particular, that the processor: […]</p>
<p>(e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III</p>
</blockquote>
<p>One way in which Google Analytics fulfills this responsibility is in offering a user interface through which the data controller can search the pseudonymous user profiles by a user's ClientID, and can export or delete that user's profile.</p>
<p>Google Analytics is often – but not necessarily – used together with Google's Ads products. For those, Google is the data controller, and could be a valid target for a DSAR.</p>
