Avast Software, s.r.o. – €14,040,000 Fine (Czech Republic, 2024)

On a basis of an anonymous complaint submitted on 22 February 2020 and a major media case, the DPA started an investigation against Avast Software s.r.o. (‘the controller’ or ‘Avast’), a company providing antivirus software services and browser extensions (‘add-ons’). For at least two months in 2019, Avast allegedly collected and sold a portion of their users’ browsing data with a company called Jumpshot, INC. Specifically, they shared pseudonymised browsing history linked to a unique identifier of approximately 100 million users through the add-ons. Jumpshot, INC. claimed to provide this data to marketers, offering insights into consumer online behavior and ‘atomic-level’ user browsing tracking. The decision-making process consisted of 2 parts – first instance ruling by the DPA and second instance ruling by the Appellant Body within the same DPA. First instance decision Due to the cross-border nature of the processing, the DPA authority of first instance submitted a draft decision with other supervisory authorities concerned in the framework of One Stop Shop mechanism. None of the supervisory authorities raised a relevant and reasoned objection to the draft decision. On 14 March 2022 the DPA found the controller was guilty for committing the abovementioned offences. In particular, the controller processed data without legal basis under Article 6(1) GDPR and in violation of transparency obligations in the privacy policy under Article 5(1)(a) and 13 GDPR. The DPA in the first instance did not dispute that the accused had legal authority to collect personal data, but claims that it had no legal basis for transmitting it to Jumpshot, INC. The controller filed an appeal arguing that : * they used robust anonymization techniques for processing; * the average user was aware that their data was processed for statistical purposes; * the purpose of transmission of data to Jumpshot INC. was compatible with the primary purpose of the processing pursuant to recital 50 and Article 5(1)(b) GDPR. Regarding the last point, the primary purpose of the processing was to conduct statistical analysis which is compatible with the purposes of processing conducted by Jumpshot INC. concerning establishment of general tendencies and trends on the market. Controller's specific arguments in the appeal before the DPA The controller explained that the anonymization process followed methods patented in the US which removed all identifiers, information that indirectly identifies the user (e.g. user ID) as well as information from which identification could potentially be inferred (e.g. unique combination of certain parameters contained in the URL). The controller also commented on the contract concluded with Jumpshot, INC. that the provision referring to anonymization as the removal of direct identifiers in reality meant much broader process of anonymization. They argued that the re-identification of data subject could not be reasonably foreseen as it was contractually prohibited. The controller admitted that this was commercial activity, however, statistical activity pursuing commercial interests also meets the definition of statistical activity under the GDPR. Moreover, the controller considered that the DPA in the first instance wrongly classified data transmitted to Jumpshot, INC. as personal data on the basis that (theoretically) two data sets could be merged and thus the data subjects could be identified. In the controller’s view this would imply that data subject can be identified anytime two data sets including general information are merged together. The controller claimed that certain information can be personal data for one person without being personal data for another person. Moreover, the controller argued that, in line with the CJEU precedents, assessing a data subject's identifiability requires considering means reasonably accessible to controllers or third parties. They contended it is unreasonable to expect third parties to use illegal means. Furthermore, the controller argued that pseudonymized or anonymized data processing for statistical analysis is common in digital companies. Regarding the transfer to Jumpshot, INC., they assert that the controller's legitimate interest outweighed data subjects' concerns since there was minimal risk, opt-out options, and benefits in commercial and product improvement pursuits. The controller complained that the DPA did not inform them in detail throughout the proceedings of what they were charged with, thereby violating Article 6(3)(a) ECHR, according to which 'everyone, who is charged with a criminal offence" has the right "to be informed promptly and in a language which he understands in detail of the nature and cause of the charge against him". The controller also considered that his procedural rights were violated by the the denial of access to cooperation mechanism records, coupled with the controller's non-participation in the One Stop Shop procedure. Another procedural defect identified by the controller was a violation of their legitimate expectations as the case was already dealt with by the DPA on 2 July 2018 in the case no. UOOU-07166/18. The controller disagreed with the argument of the DPA of first instance that the case from 2018 concerned only the development of an antivirus programme and not its add-ons. The controller finally argued that the fine imposed by the DPA of first instance is more than 5.000 higher than the sum of all fines imposed by the DPA in the three years and 50.000 times higher than the highest fine imposed by the DPA. The controller disagrees that a mere two-month-long violation without any real impact on data subjects could be so much more serious than all other breaches of the GDPR. On the question of legal basis, the DPA stated that even in the case of processing personal data for statistical purposes, disproportionate interference with the right of data subject is prohibited. The DPA agreed with the controller that an average user was aware that data controller used the data collected for statistical purposes. However, these expectations are directed towards statistics related to the controller’s business. Therefore, the average user did not expect that the controller, as a provider of data protection products, would conduct trend analysis on their data unrelated to the provided services and transfer/sell this data to third parties for their commercial interests. Additionally, the DPA considered that the information provided to data subject was contradictory and opaque as the users would have to read the Privacy Policy in detail to be aware of transmission of anonymous information. Further, the data subjects were not informed of the purpose of the processing nor the legal basis of such processing. As a result, the DPA found a violation of Article 13(1)(c) GDPR. The DPA noted that the internal identifiers of users were also processed for the purpose of trend analysis as stated in the Product Privacy Policy of the controller. Although the controller transmitted data to Jumpshot, INC. from which it removed some identifiers (but not the internal identifier), the transmitted data cannot be considered completely anonymous. Consequently, the recipients on this data had the possibility to re-identify the data subjects. On this point, the DPA concluded that the controller merely repeated that the data was anonymized without demonstrating that anonymization carried out resulted in anonymous data. Moreover, the DPA stated that the controller did not carry out the balancing test properly, namely the assessment whether the processing is necessary and whether the legitimate interest of the controller overrides the legitimate interest of the data subjects. Since the internet browser users can be re-identified, their privacy can be significantly infringed. More importantly, the DPA stressed that it was not clearly specified for what purpose and with whom data shared. The users purchased the antivirus software to protect their data and, therefore, did not expect the processing might affect their privacy. The DPA considered the controller’s argument on the content of the contract expedient. The controller was obliged to specify the subject matter of the processing regardless of the fact that in reality the controller considered anonymous data in the broader sense. The DPA can did not accept the argument that the controller did not know what they were suspected of. If that were the case, the DPA stated that the controller could have raised this objection immediately after the proceedings were initiated or at any time during the proceedings before the DPA of first instance. Regarding the violation of procedural rights in the One Stop Shop procedure, the DPA argued that neither Czech law nor GDPR provide for a procedural right of the party to the proceedings to comment on the draft decision before it is issued within the meaning of Article 60(7) GDPR, nor for the right to otherwise participate in this deliberation of the supervisory authorities. Otherwise, there could be an irresolvable procedural deadlocks. The Appellate Body explained that the principle of ne bis in idem cannot be invoked as the previous decision focused on the compliance of the controller with the obligations under Article 5(2) and 24(1) GDPR. That decision did not prevent the continuation of offense proceedings initiated separately. Users were thus misinformed by Avast about the transmission of anonymous data for the purpose of trend analysis. It was shown in the proceedings that the data transmitted from individual antivirus software installations was not anonymised, as the transmitted data could re-identify at least some of the data subjects. Regarding the fine imposed, the DPA said that they did not deal wth similar processing of personal data in the past. The case is unprecedented in the way of data processing, its scope, number of data subjects and possible impact on their rights. Therefore, the DPA imposed a record fine of CZK 351 million (€13,9 milion) for a failure to sufficiently inform the data subjects about the purpose of the treatment for which they were intended as per Article 13 GDPR and for processing in violation of Article 6(1) GDPR, as the controller lacked a valid legal basis.