Court case W137 2255764-1 – Court Ruling (Austria, 2023)

This judgement stems from one of the 101 complaints filed by the NGO noyb in the context of data transfers to the US. The data subject lamented a violation of Chapter V GDPR due to the unlawful transfer of their personal data in lack of a valid legal basis. The controller made use of analytical tools by Google on their website. When visiting such a website, the data subject triggered a transfer of personal data to the US, where Google processes personal data imported from Europe. Data transfers between US and EU were originally based on an Adequacy Decision by the Commision, in turn based on the transatlantic legal framework known as 'Privacy Shield'. Nevertheless, after C-311/18 (“Schrems II”), the Commission’s adequacy decision concerning was invalidated by the CJEU. Consequently, controllers could export data only on the basis of alternative tools guaranteeing an adequate level of protection, such as Standard Contractual Clauses (SSCs). The Austrian DPA held that SSCs implemented by the controller – the “data exporter” – could not guarantee an adequate level of protection, mainly due to their inability to limit the power of US intelligence agencies to access personal data stored by Google. The controller appealed the decision. The controller claimed that data transferred were not personal data and that in any case Chapter V GDPR envisages a risk-based approach, which was taken into account by the controller. Finally, the controller also argued that the data subject had no legitimation to bring action, as at the time of the events they were working for the NGO that represented them in the procedure before the DPA. The Austrian Federal Administrative Court (Bundesverwaltungsgericht - BVwG) rejected the appeal. First, the court denied that the fact that the data subject worked with the NGO representing them pursuant to Article 80 GDPR could exclude their legitimation to file a complaint against the controller. About the qualification of the information transferre