Avast Software, s.r.o. – €14,040,000 Fine (Czech Republic, 2024)

On a basis of an anonymous complaint submitted on 22 February 2020 and a major media case, the DPA started an investigation against Avast Software s.r.o. (‘the controller’ or ‘Avast’), a company providing antivirus software services and browser extensions (‘add-ons’). For at least two months in 2019, Avast allegedly collected and sold a portion of their users’ browsing data with a company called Jumpshot, INC. Specifically, they shared pseudonymised browsing history linked to a unique identifier of approximately 100 million users through the add-ons. Jumpshot, INC. claimed to provide this data to marketers, offering insights into consumer online behavior and ‘atomic-level’ user browsing tracking. The decision-making process consisted of 2 parts – first instance ruling by the DPA and second instance ruling by the Appellant Body within the same DPA. First instance decision Due to the cross-border nature of the processing, the DPA authority of first instance submitted a draft decision with other supervisory authorities concerned in the framework of One Stop Shop mechanism. None of the supervisory authorities raised a relevant and reasoned objection to the draft decision. On 14 March 2022 the DPA found the controller was guilty for committing the abovementioned offences. In particular, the controller processed data without legal basis under Article 6(1) GDPR and in violation of transparency obligations in the privacy policy under Article 5(1)(a) and 13 GDPR. The DPA in the first instance did not dispute that the accused had legal authority to collect personal data, but claims that it had no legal basis for transmitting it to Jumpshot, INC. The controller filed an appeal arguing that : * they used robust anonymization techniques for processing; * the average user was aware that their data was processed for statistical purposes; * the purpose of transmission of data to Jumpshot INC. was compatible with the primary purpose of the processing pursuant to recital 50 and Ar