¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
PROTECTION OF PRIVACY AND TRANSPARENCY OF THE STATE
FOR INTERNAL USE
Holder of information: Data Protection Inspectorate
Notation made: 13.07.2022
The access restriction shall be valid until: 13.07 2097
The base: § 35(1)12 of the AvTS § 35 lg 1 p 3, AvTS §
35 lg 1 p 12
Notice of termination of Termination of proceedings personal data protection case
1. The factual circumstances
The Data Protection Inspectorate (the Inspectorate) received a complaint from
(the applicant), represented through , concerning
the transfer of the applicant’s personal data to the United States by (the data
controller) and the violation of the general data transfer principles. The leading supervisory
authority for the complaint is the Estonian Data Protection Inspectorate, as the controller has
its place of business in the Republic of Estonia.
On 12 August 2020, at 11:44 a.m., the applicant visited the controller’s website
. He was logged in to his Google account at the time of his visit,
which is linked to the applicant’s email address . The controller had
added the Javascript code for Google services (including Google Analytics) to its website.
During the visit to the page, the controller processed the applicant’s personal data (at least the
applicant’s IP address and cookie data). Some of this data was transferred to Google. Under
Section 10 of the Google Advertising Services Data Processing Agreement 1, the Data
Controller agrees that Google may process personal data, inter alia, in the United States. A
legal basis is required for such transfers, which is in line with Articles 44 et seq. of the
General Data Protection Regulation (GDPR). According to the applicant, the controller had no
legal basis for transferring the data to the United States.
2. Conduct of the proceedings and reasons for the inspection
On 3 June 2021, the Supervisory Authority commenced surveillance proceedings in order to
investigate more closely the circumstances related to the infringement and sent an inquiry to
the controller on 10 June 2021, to which the controller replied on 19.7.2021.
The Data Controller explained that it will use the tool on the basis of standard terms and
conditions concluded with Google, which include, inter alia, a data processing agreement
under which Google may not process personal data for its own purposes or those of third
parties. In addition, the controller considered that the IP address could not be regarded as
personal data for the controller (and also Google) in the present case, in the absence of
additional legal means to identify a particular person on the basis of the IP address. The
controller also confirmed that, as a rule, it will not transfer personal data to Google, but that,
to the limited extent that personal data may be transferred, appropriate safeguards are
provided in accordance with the GDPR.
The Supervision Authority did not agree with the explanations provided by the controller and
justified its position as follows.
The applicant’s personal data were exported to
, because the controller used Google Analytics on
1
Google Advertising Services Data Processing Agreement — Available:
https://business.safety.google/adsprocessorterms/
Tatari tn 39/10134 Tallinn/627 4135/ [email protected] / www.aki.ee
Registry code 70004235
the website and, in the case of that export, the standard data
protection clauses concluded between the controller and do not guarantee
the same level of protection as Article 44 of the GDPR, because:
i) is a provider of electronic communications services within the meaning
of Section 42of Title 50 of the U.S. Code and, under Title 50, Section 1881a of the
U.S. Code, it is supervised by the US Secret Services; and
ii) The additional measures taken by in addition to the standard data
protection clauses do not protect the applicant’s personal data against access by the
American secret services;
Consequently, no other legislation in Chapter V of the GDPR can be relied on and,
consequently, the controller undermined the level of protection of the applicant’s
personal data guaranteed to it by Article 44 of the GDPR.
According to the Inspectorate, both the controller and have different elements to
distinguish between the visitors of the website Although unique
identifiers do not in themselves make individuals identifiable, it has to be taken into account
that in this case (and in general for the technology industry as a whole), these unique
identifiers can be combined with additional elements. Additional elements in this case
include, but are not limited to, the specific website visited by the person, the metadata of the
browser and operating system, the date and time of the visit to the website, the IP address, etc.
The controller cannot rely on any of the provisions of Chapter V of the GDPR for the transfer
of the applicant’s personal data, namely its unique identifiers, its IP address and the browser
and metadata to in the United States.
The Data Protection Inspectorate required the Data Controller to bring the data processing
into line with Articles 44 et seq. of the GDPR, in particular by suspending the processing
related to the current version of Google Analytics within one month (by 28 April 2022) on the
basis of which personal data is transferred to .
26.04.2022 The controller confirmed to the Supervision Authority that the Google Analytics
tool has been removed from the website. The Inspectorate verified the withdrawal of the tool
from the controller’s website after the controller informed the Inspectorate of it. As the
violation has been eliminated, the Supervision Authority will therefore terminate the
supervision proceedings in this case.
This notice of termination may be challenged within 30 days by submitting either:
— an appeal pursuant to the Administrative Procedure Act to the Director General of the Data
Protection Inspectorate, or
— an appeal under the Code of Administrative Court Procedure before the administrative
court (in this case, the challenge in the same case can no longer be examined).
With respect
(signed digitally)
Lawyer
under the authority of the Director General
2
Us Code e. U.S. Law — Available: https://uscode.house.gov/
2 (2)