None of your business ('NOYB') published, on 13 January 2022, the Austrian data protection authority's ('DSB') decision, as issued on 22 December 2021, in which the DSB found an unnamed EU website operator in violation of Article 44 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') for exporting personal data to an importer in the U.S., Google LLC, through ongoing use of Google Analytics without ensuring an adequate level of protection, as required under Chapter V of the GDPR, following a complaint of a complainant represented by NOYB to the DSB in August 2020 - one of the 101 complaints filed by NOYB against EU companies for continued use of Google Analytics and
News
Austria: DSB finds use of Google Analytics unlawful in light of Schrems II ruling
January 13, 2022
Summary
The Austrian Data Protection Authority (DSB) ruled that an EU website operator's use of Google Analytics was unlawful under GDPR Article 44, following a NOYB complaint. Google's reliance on Standard Contractual Clauses (SCCs) and supplementary measures was deemed insufficient against U.S. surveillance laws post-Schrems II. The DSB concluded that the data transferred constituted personal data and lacked adequate protection. While the website operator was found in violation, no penalties were imposed as the operator had merged with a Munich-based company, and any transfer ban would fall under German jurisdiction.