[...] – Complaint Upheld (Germany, 2021)

The complainant lodged a complaint with the Bavarian DPA (BayLDA) regarding the use of the newsletter tool Mailchimp by the respondent, a German company. He argued that the transfer of email addresses of subscribers of the respondent's newsletter to the provider of Mailchimp (The Rocket Science Group LLC, an US based company) was unlawful under Article 44 et seqq. GPPR. The respondent argues that the use of MailChimp was only occasional and it stopped using it. The BayLDA held that the use of Mailchimp by the respondent and thus the transfer of the email addresses to the provider of Mailchimp was unlawful: *The data transfer was based on EU standard data protection clauses (Standard Contractual Clauses - SCCs). *According to the BayLDA, there were indications that the provider of Mailchimp qualifies as "electronic communication service provider" under US surveilliance law (FISA702 (50 U.S.C. § 1881)). Therefore, the transferred email addresses could be in danger of being accessed by US intelligence services. *In the light of the CJREU decision "Schrems II" (C-311/18) the respondent had failed to assess if there were additional measures in place to ensure that the transferred data was protected from US surveillance. As the respondent declared to refrain from using Mailchimp with immediate effect, the BayLDA did not impose a fine.