You asked
I am writing to submit a request for information under the Freedom of Information Act 2004, regarding the 2021 UK Census.
1) Please can you confirm on what date and upon which agreement you have entered into with Google for this service - https://support.google.com/analytics/answer/3379636?hl=en i.e. Google Analytics 360 or standard terms (https://marketingplatform.google.com/about/analytics/terms/gb/)
2) Can you provide a summary of the access rights granted to the account i.e. Numbers of people with access rights at each permission level (as defined at https://support.google.com/analytics/answer/2884495?hl=en) for
- Managing Users
- Edit
- Collaborate
- Read & Analyse
Please can you confirm this for internal employees and external contractors
2a) Can you confirm this information retrospectively i.e. At today's date and at the 21st March 2021
3) Can you confirm with regard to GDPR & UK GDPR the roles you believe you and Google have i.e. Data Controller / Data Processor ?
4) Can you confirm in which Geographical territory Google processed the data.
5) Has the data stored within Google Analytics been accessed via any other mechanism other than the GA web interface ?
We said
Thank you for your request.
1. We entered into a contract for Google Analytics 360 with an approved vendor on November 1st 2020.
2. As of the 04/05/2021
- Managing Users: 3 users
- Edit: 4 users (includes one external contractor from the vendor for support access)
- Collaborate: 5 users (includes one external contractor from the vendor for support access)
- Read & Analyse: 35 users (includes one external contractor from the vendor for support access)
- Internal employees and external contractors: see above
2a. As of the 21/03/2021
- Managing Users: 3 users
- Edit: 4 users (includes one external contractor from the vendor for support access)
- Collaborate: 5 users (includes one external contractor from the vendor for support access)
- Read & Analyse: 35 users (includes one external contractor from the vendor for support access)
3. ONS are the controllers of all personal data collected in relation to the 2021 Census. Google Analytics process fully anonymised data on our behalf. To facilitate this ONS have entered into a relationship with Google for this analytics data. This was done specifically to allow us to secure our analytics data and report on potential bot traffic, anything nefarious that may have put Census data at risk and capture when groups of opted in users have pain points in the service so that we can focus our effort in future design iterations. The data shared with Google is completely anonymous and cannot be linked with the data captured by the user from their Census questionnaire. It is important to note that we have not enabled any of the advertising features available (enhanced demographics, benchmarking and advertising options). This is in line with the UK government's accepted practice for cookie and GA usage.
4. This is set to Europe for our BigQuery data. We obfuscate all PII data using techniques like IP anonymisation to ensure we do not capture the user's full IP address before sending the data to Google Analytics. As such we do not restrict where google process the Google Analytics data. This data is used to help us improve the census service and identify where groups of users are having trouble. All Census responses and processing of the Census data is carefully managed and stays within the UK.
5. Yes. We ingest the Google Analytics data into a BigQuery environment. This data is then ingested into our data warehouse solution. This is a Google Cloud Platform hosted environment held within the UK. Reports are built from the underlying data using both Google Data Studio and Looker. These are used to help us target our effort to maximise census responses.