noyb – Complaint Upheld (France, 2022)

The respondent is an online retail company. The complainant is an individual represented by noyb - European Centre for Digital Rights. In August 2020, the French DPA (CNIL) received a complaint regarding the transfer of personal data of the complainant to the US, collected during their visit to the respondent's website. This complaint was [https://noyb.eu/en/101-complaints-eu-us-transfers-filed one of 101 filed by noyb] against controllers that allegedly transfer personal data to the US without respecting the requirements set out by the CJEU in C-311/18. As such, the DPA opened an investigation into the company's processing activities. First, the CNIL sent a questionnaire and a request for additional information to the respondent, both concerning the transfer of data from visitors to the French version of the respondent's website which integrates the Google Analytics functionality. The respondent replied that the statistics obtained via this service concerned people in several Member States, with the effect that this processing was of a cross-border nature (Article 4(23)(b) GDPR). The CNIL nonetheless remained the lead supervisory authority as the company's main establishment was in France. Interestingly, after the CNIL submitted a draft decision to the authorities concerned (Article 60 GDPR), none of these submitted any reasoned objections. This may signal that future similar cases will have the same outcome. = The CNIL first considered what the processing operation consisted of and who the controller was. The processing operation consisted of the integration of the Google Analytics functionality on the company's website for the purpose of measuring the audience and performance of its media campaigns. This service allowed for the tracking of users by associating their unique identifier with data from a session launched from their devices. When this information is collected, it is transmitted to Google Analytics servers hosted in the US. The respondent was foun