Meta Platforms Inc. – Complaint Upheld (Austria, 2023)

== About a month after the "Schrems II ruling" by the CJEU (CJEU - C-311/18 - Schrems II) the NGO noyb filed 101 complaints regarding data transfers from EEA based websites to Google LLC and Facebook Inc. in the US (see [https://noyb.eu/en/101-complaints-eu-us-transfers-filed here] and [https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers here]). In order to coordinate the work of all involved DPAs, the EDPB created a special task force. This decision by the Austrian DPA stems from one of those complaints. == On 12.08.2020, the data subject visited a website hosted by an Austrian media company while logged into his personal Facebook account. At the time, such company made use of the Facebook Login tool, which facilitates users´ access to services not offered by Meta without the creation of additional accounts. The company also used the Facebook Pixel tool and it was thus able to track visitors´ activities on its website. According to the data subject (represented by noyb), the mere access to this website triggered an unlawful transfer of personal data to the US. In particular, the controller would have transferred data in violation of Chapter V GDPR. Therefore, on 18.08.2020 the data subject filed a complaint against the media outlet for the use of such tracking tools lamenting the violation of Articles 44 et seqq. GDPR. In addition, the data subject claimed that Meta infringed Articles 5(2), 28 and 29 GDPR. During the investigations of the Austrian DPA, which took several months, the controller claimed to have deactivated the Facebook tools after the complaint was filed. In addition, it argued that the only controller´s direct contractual party was Meta Platforms Ireland Limited. Consequently, subsequent transfers, including transfers outside the EU, were outside its area of competence. Finally, the company declared that transfers were justified in light of media privilege. Meta Platforms Inc. claimed to be a mere sub-processor on behalf of Meta Pla