According to the Schrems judgment, that the DPA considered up-to-date, this legislation doesn’t meet the requirements of EU law. Under national US law, Google LLC, as a provider of electronic communication services is subject to surveillance by the intelligence agencies and is thus obliged to provide the US government with personal data. Referring to CJEU Schrems II judgment, the DPA noted that the use of SCC’s is not in itself sufficient to achieve an acceptable level of protection in the context of data transfers to the US and that an analysis of the national provisions must be carried out. Thirdly, the DPA assessed the compatibility of the transfer with Article 44 GDPR and if it was supported by a transfer basis under Chapter V GDPR. By determining the means and purposes of the processing, Tele2 qualified as the controller. Secondly, the DPA held that Tele2 decided to implement the Google Analytics tool on its website for its own analytics purposes. The DPA outlined that although such unique identifiers would not make the users identifiable in themselves, they could be combined with additional elements and enable to distinguish individual visitors. Indeed, generic IP address and users’ unique identifiers collected through cookies were transmitted to Google LLC. For example, it held that the data transferred was anonymized in such way that the users would not be identifiable.įirstly, the DPA assessed whether the data processed through Google Analytics tool constituted personal data and found that it did. In its defense, the controller explained that the transfer was based on SCC’s concluded with Google Analytics pursuant to Article 46 GDPR and that it put in place additional safeguards. Following the complaint, the DPA investigated the data transfers from the controller to the US through the use of Google Analytics. The complaint was transferred to the Swedish DPA in its quality of lead supervisory authority pursuant to Article 56 GDPR. In 2020, noyb lodged a complaint against the controller with the Austrian DPA, alleging that the transfer of personal data through the use of Google Analytics tool was in violation of the provisions of Chapter V GDPR. For the use of this tool, the controller transferred users’ personal data to the processor, in the US. Tele2 Sverige Aktiebolag (the controller) used Google Analytics tool provided by Google LLC (processor) on its website. 4 English Machine Translation of the DecisionĮnglish Summary Facts.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |