DPA case 101 Complaint (12.10.2023) – Complaint Upheld (Estonia, 2023)

This decision stems from one of the 101 complaints filed by the NGO noyb in 2020. On 12 August 2020, the data subject visited the controller’s website, which made use of Google Analytics tools. Therefore, personal data were transferred to the U.S. at the moment of the visit. The data subject claimed that, following the CJEU judgement in case C-311/18 (‘Schrems II’) invalidating the Commission’s Privacy Shield, the transfer occurred in lack of any valid legal basis. The complaint was originally lodged with the Austrian DPA, which transferred the file to the Estonian one, considering the latter Leading Supervisory Authority (LSA) in the case at issue. The controller had indeed its main establishment in Estonia. The Estonian DPA started an investigation in the context of Article 60 GDPR. The Estonian DPA found that the controller unlawfully transferred personal data to a third country. In particular, none of the legal bases of Chapter V GDPR could be used for the transfer. As a matter of fact, Google – the data recipient – qualified as a provider of electronic communications services under US law and was therefore subject to disclosure obligations in case of request by the American secret services. As established by the CJEU in the ‘Schrems II’ judgement, this practice was not in line with EU data protection guarantees. The Standard Contractual Clauses (SCC') implemented by the controller and Google were not sufficient to compensate for this lack of protection from access by public authorities. Thus, the DPA ordered the controller to stop the processing. The controller removed Google Analytics from its website and the DPA decided not to take further measures.