Dagens Industri Aktiebolag – Complaint Upheld (Sweden, 2023)

Dagens Industri Aktiebolag (the controller) used Google Analytics tool provided by Google LLC (processor) on its website. For the use of this tool, the controller transferred users’ personal data to the processor which stored it on servers in different countries, including in the US. In 2020, noyb lodged a complaint against the controller with the Austrian DPA, alleging that the transfer of personal data through the use of Google Analytics tool was in violation of the provisions of Chapter V GDPR. The complaint was transferred to the Swedish DPA in its quality of lead supervisory authority pursuant to Article 56 GDPR. Following the complaint, the DPA investigated the data transfers from the controller to the US through the use of Google Analytics. In its defense, the controller stated that according to its internal assessments, individuals were not identifiable on the basis of the transferred data. It added that the transfer was based on SCC’s concluded with Google Analytics pursuant to Article 46 GDPR and that it put in place additional safeguards. Firstly, the DPA assessed whether the data processed through Google Analytics tool constituted personal data and found that it did. Indeed, generic IP address and users’ unique identifiers collected through cookies were transmitted to Google LLC. The DPA outlined that although such unique identifiers would not make the users identifiable in themselves, they could be combined with additional elements and enable to distinguish individual visitors. Secondly, the DPA held that Dagens decided to implement the Google Analytics tool on its website for its own analytics purposes. By determining the means and purposes of the processing, Dagens qualified as the controller. Thirdly, the DPA assessed the compatibility of the transfer with Article 44 GDPR and if it was supported by a transfer basis under Chapter V GDPR. Referring to CJEU Schrems II judgment, the DPA noted that the use of SCC’s is not in itself sufficient to achieve an acceptable level of protection in the context of data transfers to the US and that an analysis of the national provisions must be carried out. Under national US law, Google LLC, as a provider of electronic communication services is subject to surveillance by the intelligence agencies and is thus obliged to provide the US government with personal data. According to the Schrems judgment, that the DPA considered up-to-date, this legislation doesn’t meet the requirements of EU law. Fourthly, considering that the SCC’s were not sufficient, the DPA assessed whether the controller and the processor implemented additional safeguards for the data transfers. It noted that technical measures were in place but that these measures did not prevent the US intelligence agency from accessing the data In conclusion, the DPA found that the transfer of data could not rely on any of the Chapter V tools and that the controller undermined the level of protection of the data subjects’ data, in breach of Article 44 GDPR. Taking into account that the controller carried out an extensive analysis of the processing and implemented measures to try to limit risks of breaches, the DPA decided not to impose a fine and to only order the controller to remedy the deficiency.