Description of the legitimate-interest balance test on the use of the Google Analytics tool on vttresearch.com

The Google Analytics tool is used on vttresearch.com to measure and monitor the performance and use of the online service. This is essential for VTT Technical Research Centre of Finland Ltd's operations and electronic communications, in order to improve the performance of the online service and to monitor its functionality.

The Google Analytics tool does not store the user's personal data (such as name, address, contact details, GPS location data), but the tool uses the user's IP address to transfer the data from the site to the server, and it is anonymised by removing the IP address's D block before the data is stored in the database. In this case, the IP address of an individual user is not stored in the tool database. Instead, it is used only to maintain the server connection during the user's visit. The Google Analytics tool uses an anonymous, randomly generated identifier (‘Client ID’) to identify a browser that visits the site consecutively as a single browser, and to combine consecutive page downloads into a page download generated by the same browser during a single visit (session).

The above-mentioned Client ID information is stored in the first-party cookie ‘_ ga’ and is forwarded to the Google Analytics tool server when the web browser downloads a page. Since this anonymous Client ID information is readable by the website and can be used to identify a single browser during repeated visits and to link the browser concerned to the user's behaviour in the online service, it can be viewed as user's personal data according to the European Commission's guidelines.
https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en

According to Section 25 of Directive 2002/58/EC, storing data on a user's terminal equipment using different methods, such as cookies, may be justified and useful, for instance for examining the effectiveness of the design and advertising on a website and for checking the identity of users involved in online transactions. Where such methods, such as cookies, have a legitimate purpose, such as facilitating the provision of information society services, their use should be allowed, provided that the user receives clear and accurate information in accordance with Directive 95/46/EC on the purpose of cookies or similar methods, in order to ensure that the user is aware of the information received by their terminal equipment.
 
The user information stored on vttresearch.com is an anonymous and randomly formed identifier that enables VTT Technical Research Centre of Finland Ltd to use its own website for the purpose of examining and developing the effectiveness of lawful statistics and analysis, the design of the website and marketing communications. In this case, statistics on the use of the service, which are as extensive as possible, are essential for the development of vttresearch.com and for monitoring its performance. The use of the website is entirely voluntary for users, and it does not actively offer functionalities in exchange for compensation. In this case, an agreement between the user and the VTT Technical Research Centre of Finland or the user's specific consent, for instance, are not justified as grounds for processing the data.

The legitimate-interest processing criterion requires that the interest presented by the data processor is lawful, on the grounds of either EU law or national law. The interest must also be a timely and an immediately created need. The daily business and communications of the vttresearch.com website and its maintainer, VTT Technical Research Centre of Finland Ltd, require an electronic communication channel and its use in the most efficient and user-friendly manner possible. Maintaining and developing the site requires information about the use, performance, and behaviour of users on the site.

Without processing and storing Client ID data using separate browsers, it will not be possible to combine the operations performed on the site into a single user session or to identify users who may return to the service, in order to assess the user activity of the service. This information is essential for improving the availability and user-friendliness of the vttresearch.com site. Viewing individual page loads without the ability to include them in the user path would only allow a purely technical performance assessment.

The implementation of the measures described above and the development of the online service in the interests of VTT Technical Research Centre of Finland Ltd require processing of Client ID data in connection with the technical data transmitted by the user's terminal device and the data describing the use of the service. Similar results could also be achieved with other technical solutions, but they would not be better for the user's privacy.

Anonymous Client ID data can also be overwritten by storing the user's full IP address, but the IP address might be permanently associated with a single terminal device or user. Client ID data is generated occasionally when the user visits the service, and cannot be technically connected with the user's behaviour, for example in other services. The IP address, on the other hand, would enable the technical integration of data in other services as well.

Another option for an anonymous Client ID is for the identifier to be calculated based on the properties of the user's terminal device or the permanent identifier (so-called Canvas Fingerprint, or Advertising ID) obtained from the device. The Advertising ID is considered to be personal data under the GDPR in the European Commission's guidelines https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en An identifier (such as Canvas Fingerprint) that is calculated for a user's device is not easily changeable or removable by the user. Thus, using it instead of the Client ID would interfere with the privacy of the user entered in the registry more than the Client ID that the user can change or delete.

Based on this, the default Client ID used by the Google Analytics tool has been selected as data to process which affects the user's privacy, as well as the information associated with the use of the service and the user's terminal device.

As described above, the benefits of VTT Technical Research Centre of Finland Ltd, which serves as the data controller, are significant in order to implement marketing communications for the entire organisation and to maintain and develop the vttresearch.com website, which serves as the primary communication channel. Failure to process the data would prevent the entire vttresearch.com site content from being appropriately developed.

Information about the use of the site, as well as the anonymous Client ID, stored in a registry maintained in the Google Analytics tool, does not allow the identification of an individual user as a person, nor does it allow the linking of data to other personal data in other registers. Based on the information, it is possible to profile user groups on the site, but these profiles cannot be connected to the user in other services. Google Analytics offers the ability to combine this information in other services, such as for targeting advertising (so-called advertising features). However, this option is not used and these features are not enabled in the Google Analytics tool on vttresearch.com.

The use of the Google Analytics tool is determined by the terms and conditions agreed on between VTT Technical Research Centre of Finland Ltd and Google LLC, which in themselves prohibit the storage and transmission of personal identifiable information (PII) to the register maintained by the Google Analytics tool. Under these agreements, VTT Technical Research Centre of Finland Ltd is a data controller and Google LLC a data processor that processes data on behalf of VTT and does not transmit it to third parties or use it to target advertising, for example, when the so-called advertising features are not turned on in the Google Analytics account used by VTT. Further information: https://marketingplatform.google.com/about/analytics/terms/us/, https://policies.google.com/technologies/partner-sites, https://support.google.com/analytics/answer/2700409

Online analytics solutions such as Google Analytics have been widely available on different websites for decades. At least 65% of websites on the Internet use this type of analysis tool (https://w3techs.com/technologies/overview/traffic_analysis). Therefore, an Internet user can, as a rule, expect that the information transmitted and stored in their browser will be used to measure different services and analyse user behaviour.

VTT Technical Research Centre of Finland Ltd provides services and content primarily for companies and communities, in which case most of the use of vttresearch.com takes place in a context related to the work or business carried out by individuals. On these grounds, it is not expected that there will be minors or other special groups using the service, whose right to privacy should be particularly well protected.

All data stored and processed using the Google Analytics tool is functionally differentiated from other VTT Technical Research Centre of Finland Ltd data (e.g. customer data) and cannot be technically combined with these other data. Based on the use of the service, it is not possible to draw conclusions about an individual person or organisation that might affect other decisions. Client ID data is anonymous as a rule. On these grounds, an individual person cannot be identified and the data cannot be reconverted into plain-language personal data.

All data is stored on servers in the Google Analytics tool that are separately described in Google LLC documents. Data storage follows both physical and technical data protection and encryption techniques. https://privacy.google.com/businesses/security/

We want to ensure transparency and enable the user to express their will on the processing of information about themselves. The Client ID information that is stored in the Google Analytics tool used by VTT enables you to identify a single browser whenever a user visits the service using this browser. However, many terminal devices may be in shared use, in which case the user should be able to prevent the aggregation of data generated from use by different persons (Directive 2002/58/EC, Section 25). In addition, the ‘legitimate interest’ as a grounds for processing data requires that the user has an effective opportunity to object to the processing of their data. If you oppose the storing and processing of your data by means of the Google Analytics tool, we will immediately stop storing and transmitting your data to the tool from the browser you used to oppose processing. As a result, your browser can store information (a cookie, storage item, other similar item) about the objection so that we can continue to prevent your data from being transmitted and stored in Google Analytics.

The information to be recorded only contains information about your choice or objection and does not contain any information that can be connected to the user.

Changing tracking settings

You can change your settings or oppose use of different systems in the settings menu.

Tracking settings