City of Helsinki – Violation Found (Finland, 2022)

The cities of Helsinki, Espoo, Vantaa and Kauniainen (the controllers) used Google Analytics and Google Tag Manager, with servers located in the US, as a tracking technology tool on their online system (https://helmet.fi) of public libraries to monitor visitors and improve the service. The controllers installed cookie tracking technologies on the data subjects' terminal devices as soon as the website was accessed, even before a cookie banner would be shown to them. Information about processing of personal data was available on the library website under the "About the website" link. However, this general privacy note would not inform data subjects about data transfers to the US, but only mention that "some service providers are located outside of the EU/EEA" without specific information on the recipients in third countries. Information about the tracking technologies was also provided under the heading "Cookies". In light of the CJEU Schrems II judgement, the Finnish DPA started an ex officio investigation into the controllers' data transfers to third countries. The DPA considered four main issues: legal basis for processing of personal data collected through tracking technology tools, information given to data subjects related to the use of tracking technologies, implementation of technical and organisational measures for sharing data on search results with third parties, legal basis for data transfers to third countries. First, with regards to the legal basis for processing personal data collected through the tracking technology, specifically Google Analytics and Google Tag Manager, the DPA noted that certain cookies were set on the website before an interaction with the cookie banner. Such cookies were not strictly necessary and therefore required valid consent of the data subject. The DPA held that the controllers violated Articles 5(1)(a) and 6(1) GDPR, which require a valid legal basis for the processing of personal data. Moreover, the DPA found a violation of Article 25(1) GDPR because the controllers failed to effectively implement the principle of lawfulness under Article 5 GDPR. Second, the DPA assessed the information provided to data subjects and recalled that information on processing should be easily accesible to data subjects. The DPA held that providing the privacy notice in a section called 'About the website' was not clear and violated the principle of transparency (Article 5(1)(a) GDPR). The DPA also noted that the controllers were obliged, under Article 13(1)(e) GDPR to inform data subjects about transfers to third countries. However, the information provided was too general and not sufficient as it did not include the third countries nor recipients with whom data outside the EU would be shared. Hence, the DPA found a violation of Articles 5(1)(a), 13 and 25(1) GDPR. Third, the DPA considered that using Google Analytics for the search result page could lead to a security breach in the form of sharing the data with unauthorised third parties. The DPA explained that search data on a library website can reveal a considerable amount of information about a person's private life and can be used, for example, to create a personal profile of the data subject. The negligent processing of personal data by the controllers led to the transmission of this information at least to Google. Therefore, the DPA held that the controllers violated Articles 32(1)(2) and 25 GDPR by systematically and unintentionally disclosing personal data to third parties through an 'obvious' lack of technical and organisational measures as well as a failure to implement the principle of privacy by design. Fourth, the DPA assessed whether the controllers had a valid legal basis for transferring personal data to the US. The DPA recalled that since the Schrems II judgement, controllers could no longer rely on the Privacy Shield adequacy decision. The DPA held that the controllers breached Article 44 GDPR, which requires transfers to be carried out in accordance with the conditions of Chapter V of the GDPR, and Article 46 GDPR, which requires appropriate safeguards in the absence of a decision under Article 45 GDPR, as the controllers provided no valid legal basis for their transfers to the US. The DPA also made a general remark on the use of tracking technologies by public authorities. It held that the controllers should carefully consider what kind of tracking technology is actually necessary on their website and whether, for example, the online service could be provided entirely without tracking technologies other than those necessary for the functioning of the website. The controllers should have a legal basis for their processing activites and adequately inform data subjects of the purposes of processing. In conclusion, based on Article 58(2)(d) GDPR, the DPA ordered the controllers to bring their processing activities in line with the GDPR, including the deletion of all data collected with Google Analytics and Tag Manager, as well as updating information provided to data subjects. The DPA issued reprimands, under Article 58(2)(b) GDPR, to the controllers for violating the above-mentioned provisions of the GDPR.