Mapfre España Compañia de Seguros y Reaseguros SA – Complaint Upheld (Spain, 2024)

The controller, an insurance company, has a website that uses cookies. The data subject noticed that, even though the website had a cookie banner, the cookies were placed even before the user interacted with the cookie banner. Moreover, the cookies at hand were connected with the Google Analytics service. According to the data subject, this entailed an unlawful data transfer to the USA. Therefore, the data subject filed a complaint with the Spanish DPA. The controller acknowledged that it was using Google Analytics on its website, but argued that the relevant cookie is placed only after the data subject's consent. Moreover, the controller pointed out that it is now using the so-called "Google Analytics 4", which uses an IP-address "anonymiser". First, the DPA noted that the controller acknowledged the Google Analytics tool. Therefore, the controller processed several data of the data subject, including unique user identifiers, the IP address as well as other data associated with the browser. The DPA shared the data subject's view, holding that the controller should not have installed the cookies before the data subject's consent. Since no legal basis for this processing was present, the DPA found a violation of Article 5(1)(a) GDPR. Second, the DPA pointed out that, even though the data transfer to the USA (i.e. to Google LLC) was carried out by Google Ireland (appointed as processor pursuant to Article 28 GDPR), the controller is however responsible and liable under Chapter V GDPR (see [https://www.edpb.europa.eu/system/files/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf EPDB Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR], para. 19). As for this point, the DPA considered it irrelevant that the controller did not decide where personal data is stored by Google LLC, since the data processing agreement also mentioned the US as a place where the servers could be located. Third, the DPA held that the fact that now Google LLC adheres to the "EU-US Data Privacy Framework" is not relevant, since the complaint refers to processing activities that happened before this legal regime entered into force. Therefore, reference should be made to the previous legal framework, where no valid adequacy decision under Article 45 GDPR was in force (see C-311/18, Schrems II). Fourthly, as for the controller's migration to Google Analytics 4, the DPA pointed out that the controller provided no evidence that the IP addresses are anonymised in the EU and, thus, there is a possibility that they had been transferred to the US. Additionally, the DPA noted that the collection of IP in itself constitutes a processing of personal data. Fifthly, the DPA noted that the standard contractual clauses (SCCs) governing the relationship between the controller and the processor did not take into account the principles stated by the CJEU in case C-311/18, Schrems II. In particular, the DPA referred to the fact that, in this judgement, the CJEU held that SCCs cannot constitute an appropriate safeguard when it comes to the exercises of powers of third countries' public authorities, given the contractual nature of these clauses (see para. 126). Therefore, the DPA held that the controller could not transfer data to the US, since no adequacy decision nor appropriate safeguards under Article 46 GDPR were in place and found a violation of Article 44 GDPR. On these grounds, the DPA issued a reprimand to the controller.