View source for BVwG - W245 2252208-1/36E and W245 2252221-1/30E

{{COURTdecisionBOX

|Jurisdiction=Austria
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=BVwG
|Court_With_Country=BVwG (Austria)

|Case_Number_Name=W245 2252208-1/36E & W245 2252221-1/30E
|ECLI=

|Original_Source_Name_1=Bundesverwaltungsgericht Republik Österreich
|Original_Source_Link_1=https://www.ris.bka.gv.at/Dokumente/Bvwg/BVWGT_20230512_W245_2252208_1_00/BVWGT_20230512_W245_2252208_1_00.pdf
|Original_Source_Language_1=German
|Original_Source_Language__Code_1=DE
|Original_Source_Name_2=
|Original_Source_Link_2=
|Original_Source_Language_2=
|Original_Source_Language__Code_2=

|Type=Other
|Outcome=
|Date_Started=18.08.2020
|Date_Decided=12.05.2023
|Date_Published=12.05.2023
|Year=2023
|Fine=
|Currency=

|GDPR_Article_1=Article 44 GDPR
|GDPR_Article_Link_1=Article 44 GDPR
|GDPR_Article_2=Article 46(2)(c) GDPR
|GDPR_Article_Link_2=Article 46 GDPR#2c
|GDPR_Article_3=
|GDPR_Article_Link_3=
|GDPR_Article_4=
|GDPR_Article_Link_4=
|GDPR_Article_5=
|GDPR_Article_Link_5=

|EU_Law_Name_1=
|EU_Law_Link_1=
|EU_Law_Name_2=
|EU_Law_Link_2=

|National_Law_Name_1=
|National_Law_Link_1=
|National_Law_Name_2=
|National_Law_Link_2=

|Party_Name_1=Österreichischen Datenschutzbehörde (Austrian data protection authority)
|Party_Link_1=https://www.dsb.gv.at/
|Party_Name_2=Google LLC
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=

|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=
|Appeal_To_Link=

|Initial_Contributor=Norman Aasma
|
}}

The use of Google Analytics by an Austrian website was declared unlawful by the Austrian Federal Administrative Court. The Court also held that Chapter V of the GDPR does not apply to the Google US, the data importer.

== English Summary ==

=== Facts ===
This case concerns a judicial review against a 2021 decision of the Austrian DPA (''Datenschützbehörde - DSB''). The decision originally stemmed from a complaint filed by the NGO ''noyb,'' following the CJEU judgement in case [https://curia.europa.eu/juris/liste.jsf?num=C-311/18 C-311/18] ("''Schrems II''").  

The Austrian DPA found that the use of Google Analytics by an Austrian website led to the transfer of personal data to the US in violation of Chapter V of the GDPR. At the same time, the supervisory authority ruled that Chapter V of the GDPR sets out obligation only for the data exporter - in the present case, the Austrian website - and not the data importer - Google LLC.  

Google LLC appealed the decision. Google stated that transfers were lawful as they relied on Standard Contractual Clauses (SCCs) pursuant to [[Article 46 GDPR#2c|Article 46(2)(c) GDPR]]. It also claimed to have adopted a "risk-based approach" to the transfers, by implementing technical and organisational measures aiming at mitigating the risks to Europeans' data protection rights.  

The data subject also appealed the decision, arguing that Chapter V of the GDPR applies to data importers, too.  

=== Holding ===
In addressing the controller's appeal, the court confirmed that the data transfer to Google LLC was unlawful.   

Referring to the CJEU judgement in case [https://curia.europa.eu/juris/liste.jsf?num=C-311/18 C-311/18], the court held that SCCs can be considered effective only as long as - on their own or in combination with additional technical and organisational measures - they are able to compensate for the risks taken by a data exporter when transferring data to third countries. If the data exporter is not able to meet these requirements, data transfers are unlawful and shall not take place.  

With regard to the present case, the court found that even though Google had implemented certain organisational and technical measures, these were not sufficient to prevent US intelligence agencies from accessing Europeans' personal data. As a matter of fact, Google's own report indicated that the number of requests made by such agencies was actually very high.  

Assessing Google's organisational measures, the court noted that a contractual obligation to inform the data exporter about an access request by a public authority was not sufficient to address the risks to data subjects' fundamental rights. In case of emergency, US law enables public authorities to order the controller not to share with third parties information about the disclosure. In addition, and above all, Europeans have no effective legal remedy against unlawful disclosure. The publication of a transparency report by Google did not solve the issue, either.   

As far as technical measures were concerned, the court stressed that encryption was not an effective tool. Under US law, Google is obliged to provide the requesting authority not only with data transferred, but also with encryption keys to decypher them. More in general, the court explicitly clarified that Chapter V of the GDPR is incompatible with the "risk-based approach" envisaged by the Google. As a matter of fact, a "business-friendly interpreation" of the GDPR did not play any role in [https://curia.europa.eu/juris/liste.jsf?num=C-311/18 C-311/18] and was thus inadmissible.   

As far as the data subject's appeal was concerned, the court dismissed the data subject's arguments. The court upheld the Austrian DPA's interpretation that Chapter V of the GDPR applies only to the data exporter, and not to the data importer. The court stressed that obligations stemming from Chapter V of the GDPR should not be confused with contractual obligation binding the data importer in the context of SCCs or other private law agreements with the data exporter. 

== Comment ==
The data subject expressed their willingness to appeal the decision before the Austrian Supreme Administrative Court.

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the German original. Please refer to the German original for more details.

<pre>
Postal address:
                                                                      Erdbergstrasse 192 – 196
                                                                                 1030 Vienna
                                                                         Phone: +43 1 601 49-0

                                                                  Fax: + 43 1 711 23-889 15 41
                                                               Email: einlaufstelle@bvwg.gv.at
                                                                            www.bvwg.gv.at

decision date

05/12/2023
business number




W245 2252208-1/36E

W245 2252221-1/30E


     Written copy of the verbal decision announced on March 31, 2023


                I M N A M E N D E R E P U B L I K !



The Federal Administrative Court, judged by Mag. Bernhard SCHILDBERGER, LL.M.

as chairperson and Mag. Viktoria HAIDINGER as a competent lay judge and Mag.

Thomas GSCHAAR represented as a competent lay judge on the complaints of XXXX
by XXXX and XXXX, represented by Baker & McKenzie Rechtsanwälte LLP & Co KG,

Schottenring 25, 1010 Vienna against the partial decision of the Austrian

Data protection authority from December 22nd, 2021, GZ 2021-0.586.257 (DSB-D155.027), concerning the
Violation of the general principles of data transmission in accordance with Art. 44 GDPR, after

Carrying out an oral hearing, rightly recognised:


a)

    I. XXXX's complaint against point 2 of the disputed partial decision is

       rejected.

    II. The revision is permissible according to Art. 133 Para. 4 B-VG.



b)

    I. XXXX's complaint against point 3 of the disputed partial decision is
       rejected.


    II. The revision is permissible according to Art. 133 Para. 4 B-VG. - 2 -







                            Reasons for decision:


Subject of the proceedings:

Complainant XXXX (hereinafter also “BF1”) visited a website on August 14, 2020

XXXX of those involved XXXX (hereinafter also "MB"). On the MB website was the
Web analysis service XXXX Analytics of complainant XXXX (hereinafter also "BF2")

embedded. With the embedded web analysis service, personal data of the
BF1 transferred to a third country. The present decision addresses the question of whether

with the processing at issue to a violation of the general

Principles of data transmission in accordance with Art. 44 GDPR.


I. Procedure:

I.1. With a submission dated August 18, 2020, the BF1 lodged a complaint against the BF2 and the MB
(VWA ./01, see point II.2).

The reason given by the BF1 was that on August 14, 2020, at 10:45 a.m., the website of the MB

visited XXXX. While visiting the MB website, the BF1 was on a XXXX -

account was logged in. This account is linked to the email address of BF1 (XXXX
been. The MB has on its website the HTML code for XXXX services (including

XXXX -Analytics) embedded.

During the visit to the MB website, the BF1 received personal data from the

BF1 (at least the IP address of the BF1 and cookie data) processed. Apparently these are
been transmitted to the BF2 (VWA ./04).

According to point 10 of the order data processing conditions, the MB agreed that

the BF2 personal data of the BF1 in the United States of America or in

another country where XXXX or XXXX sub-processors have facilities
maintain, store and process. Such a transfer of

personal data of the BF1 from the MB to the BF2 require a legal basis

according to Art. 44 ff GDPR.

After the European Court of Justice declared the "EU-US Privacy Shield" with the decision of
16.07.2020, C-311/18 (Schrems II) declared invalid, the MB could

Data transmission to the BF2 in the United States is no longer limited to one

Support adequacy decision according to Art. 45 GDPR. Nevertheless, the MB and - 3 -


the BF2 still had to wait almost four weeks after the judgment for the “EU-US Privacy
Shield”. This can be done from point 10.2 of the order data processing conditions

for XXXX advertising products, version 01.01.2020 (VWA ./03).

In addition, the MB cannot base the data transmission on standard data protection clauses

in accordance with Article 46 (2) (c) and (d) GDPR if the third country of destination

Union law no adequate protection of the on the basis of
Standard data protection clauses guarantee transmitted personal data (ECJ

July 16, 2020, C-311/18 (Schrems II), para. 134 f). The ECJ expressly stated that
other transfers to entities falling under 50U.S. Code §1881a, not just

against the relevant articles in Chapter V GDPR, but also against Art. 7 and 8 GRC

would violate the essence of Art. 47 GRC (ECJ 06.10.2015, C-
362/14 (Schrems), para. 95). Any further transmission therefore violates the fundamental right

to privacy and data protection and the right to an effective remedy

a fair process.

BF2 is a provider of electronic communications services within the meaning of 50 U.S. code §

1881a (b) (49) and as such is subject to supervision by U.S.
Intelligence agencies under 50 U.S. Code § 1881a ("FISA 702"): As from the " XXXX " (VWA ./06)

and from the transparency report of the BF2 (see XXXX, the BF2 of the US
Government pursuant to 50 U.S. Code Section 1881a actively provides personal information. Before

Against this background, the MB was unable to adequately protect the

personal data of BF1, which are transmitted to BF2.

From August 12th, 2020, the MB and the BF2 have agreed on data transmissions to the United

States rely on default data protection clauses. This could be point 10.2 of
Order data processing conditions for XXXX advertising products, version 08/12/2020,

(VWA ./04). However, this procedure ignores the judgment of the European
Court of Justice (ECJ July 16, 2020, C-311/18 (Schrems II), para. 134 f). Accordingly, the MB

obliged to the transfer of personal data to the BF2 in the United

states to refrain from.

Finally accept the BF2 despite the clear judgment of the European Court of Justice

and in violation of Articles 44 to 49 GDPR, data transfers from the
EU/EEA under the data protection clauses. In addition, give the BF2

EU/EEA personal data to the US government in violation
against Art. 48 GDPR. - 4 -


According to Art. 58 Para. 1 GDPR, the BF1 requested that it be determined which
personal data from the MB to the BF2 in the United States or to a

another third country or an international organization on which

Transmission mechanism according to Art. 44 ff GDPR, the MB supports the data transmission
and whether the provisions of the applicable XXXX Analytics Terms of Use

and the (new) order data processing conditions for XXXX advertising products

Requirements of Art. 28 GDPR in relation to the transfer of personal data
fulfill or not.

Furthermore, the BF1 applied for this immediately in accordance with Art. 58 (2) lit. d, f and j GDPR

Ban or suspension of any data transfer from the MB to the BF2 in the

United States imposed and the return of this data to the EU/EEA or a
another country that guarantees adequate protection.


Finally, the BF1 requested the imposition of an effective, proportionate and
deterrent fine against the MB and the BF2.

In his complaint to the BA, the BF1 submitted the Terms of Use for XXXX Analytics (VWA

./02, see point II.2), the order data processing conditions for XXXX advertising products,

Version 01.01.2020 (VWA ./03, see point II.2), the order data processing conditions
for XXXX advertising products, version 08/12/2020 (VWA./04, see point II.2), the HAR data of the

Website visit (VWA ./05, see point II.2), the XXXX (VWA ./06, see point II.2) and

a certificate of representation (VWA ./07, see point II.2).

I.2. As a result, the BA continued the procedure until the responsible person was determined
supervisory authority and until the decision of the lead supervisory authority or the

European data protection committee with decision of 02.10.2020, Zl2020-0.527.385 (DSB-

D155.027) from (VWA ./08 and ./09, see point II.2). Furthermore, the bB called for the MB
Opinion on (VWA ./10, see point II.2).

I.3. In the statement of December 16, 2020, the MB stated (VWA ./11, see point II.2) that

she herself decided to edit the program code for XXXX -Analytics (hereinafter

also called "tool") on your XXXX. The tool is used to
to enable statistical evaluations of the behavior of website visitors (see

Point II.1.8) to organize the content of the website according to general topic interests

to adjust. Since the evaluation is carried out anonymously, the tool can be used
the content cannot be adapted to the specific website user. Based on the

Website usage and article views of anonymous users receive an aggregated MB

statistical evaluation. - 5 -


For the general user statistics and the already mentioned purpose no personal reference
is necessary, the MB was aware of the embedding of the anonymous version

determined. From the still embedded code it can be seen that the function

"anonymizeIp" was set to "true". Therefore, the tool only processes anonymous
Data. In the case of user IP addresses of the IPv4 type, the last octet and in the case of IPV6

addresses the last 80 of the 128 bits in memory are set to zero. With that find

before the data is saved or transmitted. Therefore, an access
therefore not to personal data by BF2 in the United States

possible.

In addition to anonymized IP addresses, the tool processes the user agent string. The user agent

String is used to tell the server which system specification the user used to access the
server access. Without personal reference, only the device, the operating system, the

Operating system version, the browser, the browser version and the device type are displayed

become. Since this information lacks a personal IP address or anything else
Identifiers cannot be assigned to an identifiable user, would not be personal

data available. Since the anonymization is already in the working memory of the respective

website user takes place, no processing takes place on servers of BF2 and sohin
not in a third country outside the EU.

Even before the cookie is finally set, the anonymization process finds the IP address

instead of. Only from this point in time would the statistical information about the

Website usage can be collected via the respective - now anonymous - cookie. The
The evaluations collected would accordingly only be carried out with the anonymous data

carried out and could therefore not be assigned to any person. on the

the process presented – namely the collection and evaluation of merely anonymous data
and information - would find neither the GDPR nor the DSG due to the lack of personal reference

Application. Accordingly, the consent of a website user is not required.

The concrete anonymization process initially accesses the IP address in order to access it immediately

anonymize. However, this required initial recording of the IP address takes place
regardless of the use of XXXX -Analytics and be always for the

functionality is mandatory. This survey is not for the purpose of the MB

(see point II.1.8), but inevitably with every website that can be called up on the Internet. This
takes place, as with any other website, on the basis of legitimate interest

Operation of a functioning, user-friendly and secure website in accordance with Art. 6 para.

1 lit. f GDPR. - 6 -


The BF2 process the data on behalf of and on the instructions of the MB. The MB take the role
of the person responsible, BF2 assumes the role of processor. The MB have

extensive decision-making power over the means of processing. You decide initially

about whether she wants to embed the tool at all and she also has the option to
Adjusting the tool to determine the needs and purposes of processing

or change as needed. Furthermore, the MB determines the storage period (26 months) as well as

the fate of the data after the termination of the contract. To secure any future
The MB

therefore concluded an order data processing agreement with BF2 (see VWA

./16).

According to the judgment of the European Court of Justice of July 16, 2020, C-311/18 (Schrems II).
the MB checked the settings of the tool and made sure that the so far

data protection-friendly implementation by anonymizing the IP addresses

is active. Therefore, the judgment of the ECJ is not on the contractual relationship between the MB and
the BF2 applicable. In order, however, also for any provision of personal data

To take data to the BF2 precautions, the MB with the BF2 have one as a precaution

Processor agreement concluded on August 12th, 2020 (see VWA ./16) and
Standard safeguard clauses included (see VWA ./22). With regard to the

The MB did not carry out a proactive review of standard safeguard clauses. This

because due to the transmission of anonymized IP addresses, a transmission
of personal data is not successful. Finally, arising from the processing

of anonymous data, which are subsequently only evaluated for general statistics,

no risks.

BF2 also took further technical and organizational measures (no
Backdoor access for authorities, information obligations of BF2 towards those responsible,

when a request from a competent authority arrives, publication of

transparency reports, examination of requests for information and appeals) to a high level
To provide a level of data protection for the data processed via the tool.

In its statement (VWA ./11) to the BA, the MB submitted reports from the tool (VWA ./12,

see point II.2), information on IP anonymization (VWA ./13, see point II.2),

Screenshot of the set storage period (VWA ./14, see point II.2), list of
Server locations (VWA ./15, see point II.2), order data processing conditions for

XXXX advertising products, version 08/16/2020 (VWA ./16, see point II.2),

Order data processing conditions for XXXX advertising products, version 08/12/2020
(VWA ./17, see point II.2), order data processing conditions for XXXX - 7 -


Advertising products, version 01.01.2020 (VWA ./18, see point II.2), comparison version AVV dated
01/01/2020 vs 08/12/2020 (VWA./19, see point II.2), comparison version AVV from 08/12/2020

vs 08/16/2020 (VWA ./20, see point II.2), screenshot for settings (VWA ./21, see

Point II.2), standard data protection clauses (VWA ./22, see point II.2), information on
Safety measures (VWA ./23, see point II.2) and a processing sheet for XXXX

Analytics (VWA ./24, see point II.2) at.

I.4. At the request of the bB of January 22, 2021 (VWA ./25, see point II.2), the BF1 in the

Follow an opinion (VWA ./26, see point II.2). In it he explained, although in code
the function "anonymizeIP" was set to "true", this did not result in his

anonymized IP address was transmitted. This is for data transfers in the World Wide

Web technically impossible. Referring to statements by BF2, BF1 stated that
the IP address only after it enters the Analytics data collection network,

anonymized or masked before being stored or processed.

In addition, the BF1 pointed out that at the time of the website visit, he was in his private
XXXX account was logged in and also cookie data (_ga, __gads, _gid, _gat,

_gat_UA-259349-11, _gat_UA-259349-1) were transferred. So in the result be

Contrary to the statements of the MB, it is clear that personal data (such as cookies and
IP addresses) were processed and transmitted to BF2 in the United States.

In addition, with a processor in a third country, there is a breach of anonymization

not enforceable or ascertainable
of the European Court of Justice (ECJ 19.10.2016, C-582/14 (Breyer)) at least by one

assignability to a specific natural person.

In order to prevent a violation of Art. 44 ff GDPR, a complete removal of the

Tools necessary and a change to another tool that does not transfer data to the
USA require to recommend. As far as the MB is convinced that no

personal data would be processed is a conclusion of

Order processing conditions contradictory. Also the fact that the MB
to be on the safe side, conclude standard data protection clauses with the BF2, point out that

she herself assumes that data will be transferred to the USA. Also that from

The processing directory (VWA ./24) submitted to the MB indicates that
personal data would be transmitted to BF2.

Contrary to statements by the MB, the sole purpose of collecting the IP address is not

carrying out the transmission of a message over a communications network,

rather, it is also collected for the use of XXXX analytics. As a result of possible
data tapping by US secret services can still be assumed that interests or - 8 -


Fundamental rights and freedoms of data subjects requiring protection
require personal data prevail. Like the European Court of Justice

stated that the existing system of access options from US

Secret services on personal data of EU citizens with Art. 7, 8 and 47 GRC
incompatible (ECJ July 16, 2020, C-311/18 (Schrems II)).


In its statement (VWA./26), the BF1 placed the attachments of third-party partners in the cookie banner
MB (VWA ./27, see point II.2), contacts from XXXX with US server (VWA ./28, see point

II.2), and contacts of XXXX with US server, reference to fingerprint technology (VWA ./29,
see point II.2) at.


I.5. In a letter dated February 26, 2021, the BA asked the BF2 to comment (VWA ./30,
see point II.2). With the submission of April 9th, 2021, the BF2 complied with this request (VWA

./31, see point II.2). In its statement, the BF2 describes, among other things, the

Web analysis service XXXX -Analytics (see point II.1.3.3), the implementation and the
Functionality of XXXX -Analytics (see point II.1.5), the embedding of the program code

for XXXX analytics on a website (see point II.1.6), the legal basis for use

of XXXX -Analytics (see point II.1.7), the measures which, according to the judgment of
European Court of Justice of July 16, 2020 in case C-311/18

(see point II.1.9), the additional measures that come with the introduction of the
standard contractual clauses have been set (see point II.1.10) and the effects if

a user of a XXXX account visits a website that uses XXXX analytics.

I.6. The entry of the BF2 (VWA ./32) transmitted the bB within the scope of the hearing of the parties

MB and the BF1 for comments.

I.7. With a statement of May 4th, 2021 (VWA ./33, see point II.2), the MB stated that they

only use the free version of XXXX Analytics. Both the
Order data processing conditions (terms of use) as well as the

Standard Contractual Clauses (SDK) have been agreed. The BF2 will only as

Contract processor used. The instructions are given by the MB about the settings of XXXX
-Analytics user interface and via the global website tag. It is the data release

Setting has not been activated. The code is embedded with the anonymization function

been. XXXX signals are also not used. The MB does not have its own
authentication system and also do not use user ID function. Currently support

does not refer to the exception rule of Art. 49 Para. 1 GDPR.

I.8. With a statement dated May 5th, 2021 (VWA ./34, see point II.2), the BF1 stated that

XXXX is not a party to the proceedings and is the sole object of the appeal with regard to BF2, - 9 -


that the transmission and receipt of the data Art. 44 ff DSGVO is pursued or the
thereafter unlawful processing in the United States. According to Art. 44 GDPR

"Responsible persons and processors" would have to comply with Chapter V GDPR

retain. As a processor, BF2 is the norm addressee of Chapter V GDPR. The bB be
directly responsible for BF2, which violated Art. 44 ff GDPR. Regarding

The GDPR is applicable to the processing carried out by BF2, since the factual

Scope of application according to Art. 2 Para. 1 and the geographical scope according to Art.
3 paragraph 2 lit. b leg.cit. be fulfilled.

With reference to the opinion of BF2 (VWA ./31, see point I.5), BF1 stated that

the data transmission to BF2 in the United States and the personal reference of

transmitted data is undisputed. The BF2 put out of dispute that all through XXXX -
Analytics collected would be hosted in the United States.

According to the explanations of the BF1, the MB and the BF2 themselves would assume that

that there is a processing of personal data, including their transmission in
a third country, otherwise a contract data processing contract will be concluded

including standard contractual clauses would be completely meaningless. Also state the BF2 itself,

that based on a "user ID" ("user identifer") a data subject for the purpose
of deletion can be identified. There is thus the possibility of

Identifiability within the meaning of Art.4 Para.1 GDPR. Furthermore, the BF itself states that XXXX

-Analytics unique identifiers associated with a specific user
use. As far as the BF2 explain that the data transmitted to her sometimes only

"Pseudonymous data" would be, on the one hand this is factually wrong and on the other hand it is closed

note that even pseudonymised data (Art. 4 Para. 5 GDPR) from the term
personal data are recorded in accordance with Art. 4 Para. 1 GDPR.

It is undeniable that the MB and the BF2 process personal data and in

the United States had submitted. At least some of the ones on the occasion of

Cookies set on the website visit on August 14, 2020 would be unique user
Identification numbers included. In the transaction between the browser of the BF1 and

https://tracking. XXXX , which was started on the specified date, are the user

Identification numbers _gads, _ga and _gid have been set. These numbers are in sequence
at https://www. XXXX -analytics.com/ has been transmitted. It's about the numbers

to online identifiers that serve to identify natural persons and a
Users would be specifically assigned (see also point II.1.3). In terms of

IP address, it should be noted that Chapter V GDPR no exceptions for subsequent

provide for anonymized data. It can be assumed that the IP address of the BF1 is not - 10 -


was once made anonymous in all transactions. The application for the imposition of a
Fine will be withdrawn, this is now a suggestion.


The additional measures put forward by the BF2 (see point II.1.10) are irrelevant.
In this regard, the European Court of Justice found the following elements of the US

Legislation than with the European fundamental rights according to Art. 7, 8 and 47 EU

Charter of Fundamental Rights (GRC) considered incompatible (ECJ July 16, 2020, C-311/18 (Schrems II), para
175 ff): The lack of any legal protection before US courts under Art. 47 GRC; the lack

any precise legal basis for monitoring, specifying the scope and
scope of the encroachment on fundamental rights itself and the requirement of

proportionality is sufficient; the lack of any individual ex ante decision of a

court, but the sole review of a surveillance system as a whole and that
Absence of any subsequent judicial control and finally the lack of any

Legal Protection for "Non-US Persons". Against this background, the additional

Measures (see point II.1.10) not suitable by the European Court of Justice
solve the problems presented. With comprehensive justification, the BF1 explained that no

of the supposed "additional measures" above the normal standard of the

Data processing pursuant to Art. 32 GDPR goes beyond or is relevant with regard to
U.S. Government data access pursuant to 50 U.S. Code § 1881a and/or EO 12.333.

In its statement (VWA ./34), the BF1 included the enclosures "XXXX -Analytics Cookie,

Use on website" (VWA ./35, see point II.2), "How XXXX uses cookies" (VWA

./36, see point II.2), and "Measurement Protocol Parameter Reference" (VWA ./37, see
Point II.2) at.


I.9. As a result, the bB asked the parties to the procedure to submit a new statement (VWA
./38, ./39 and ./40, see point II.2). With an e-mail dated May 12, 2021, BF2 applied for one

Extension of the period for comments (VWA ./41, see point II.2), which subsequently
was granted by the BA (VWA ./42, see point II.2).


I.10. In its statement of June 10, 2021 (VWA ./43, see point II.2), BF2 stated that
that the BF1's legitimacy to act had not been established because it had not been proven

had been stated that the data transmitted was personal data of BF1

act. In order to process the data (cookies, IP address) as a
To be able to qualify personal data of the BF1, he would have to on the basis of this

data are identifiable.

With regard to the _gid and cid numbers, it should be noted that these are first-party cookies,

which were set under the domain XXXX. It is therefore not cookies of BF2, - 11 -


but cookies of the website owner, and the cookie values are different for each user on each
site different. The BF1 stated that the numbers "_gid" and "cid" an

https://www. XXXX -analytics.com/ were transmitted. "_gid" has the value

1284433117.1597223478 and cid is 929316258.1597394734. To assess the
Active legitimation must therefore be determined whether these numbers (values) the BF1

make identifiable.

Considering that a single user may have different cid numbers for

have different websites and the cid numbers are randomly generated,
such a cid number cannot in itself identify a user. The

Number929316258.1597394734simplydon'tidentifytheBF1.TheBF1don'tbring

suggest that subsequent visits to the site would have taken place, let alone that data
in connection with such subsequent visits to the website in connection with the cid

929316258.1597394734 would have been recorded. There were no circumstances

on the basis of which one could argue that in connection with the cid number
929316258.1597394734 information collected would make the BF1 identifiable.

These statements essentially apply to the _gid numbers.

With regard to the IP address, it should be checked whether the IP address of the Internet

connected device is actually assigned to the BF1 and whether the person responsible or
another person has the legal means to obtain subscriber information from the

relevant internet access provider.

Even if it were determined that the MB or another person theoretically such

legal means within the meaning of recital 26 have to

Subscriber information related to the B1 from the internet access provider
received, it must also be determined whether, within the meaning of recital 26

GDPR reasonably likely that these means will be used
would. In general, it is not likely that the MB or any other

Person within the meaning of recital 26 legal means (if such available to them

standing) would use. In particular in the situation at issue, it would be
generally unlikely that such legal means will be used

would to identify any visitor to a website like the BF1 if

one considers the objective factors, such as the cost and time required for such means
identification (see recital 26).

As a processor, BF2 provides the website operator with numerous

XXXX -Analytics configuration options are available. The

Anonymization function is according to the declarations of the MB from December 16th, 2020 (VWA - 12 -


./11) and 05/04/2021 (VWA ./33) have been configured. However, due to a possible
Due to a configuration error on the part of the MB, the anonymization function does not work in all cases

been activated.

Under normal operating conditions and as far as users based in the EU are concerned,

there is a web server in the EEA, which is why the IP anonymization is always within

of the EEA. In the present case, normal operating conditions existed.

On August 14, 2020, the XXXX account of the BF1 ( XXXX ) has the Web & App activity
setting enabled. However, the account has not chosen activities of

Include websites using XXXX services. Since the MB according to its own information also

XXXX signal, the BF2 is not (was) able to determine that
the user of the XXXX account XXXX visited the XXXX.

With regard to international data traffic, it should be noted that even under the

Assumption that the complainant's personal data is concerned, this

are limited by their nature in terms of quantity and quality
data are to be qualified as personal data at all, it would also be

trade pseudonymous data.

Standard contractual clauses were concluded with the MB, in addition

additional measures have been implemented. The BF2 does not store user data according to EO
12333 open. FISA § 702 is in the present case given the encryption and the

Anonymization of IP addresses irrelevant.

Art. 44ff GDPR could not be the subject of a complaints procedure according to Art. 77 para.

1 GDPR, which is why the complaint should be rejected.

Finally, Art. 44 et seq. GDPR are also relevant with regard to BF2 as a data importer

not applicable.

I.11. The BF2 was entered by the bB, the BF1 and the MB as part of the
heard by the parties (VWA ./44, see point II.2). To that end, the BF1 applied

an extension of the period for comments (VWA ./45, see point II.2). Further demanded

the bB to announce the MB by letter dated June 16, 2021, whether there are legal
there have been changes and legal representation still exists (VWA ./46,

see point II.2).

I.12. With a statement dated June 18, 2021, the MB announced the change in its company name and the

Transfer of the website to another legal entity (see point II.1.2, as well as
VWA ./47, see point II.2). - 13 -


I.13.With a further statement of June 18, 2021 (VWA ./48, see point II.2). led the MB
assumes that the intended IP anonymization was not due to a programming error

had been activated. Due to the change made, now for all XXXX -

Analytics Properties activated IP anonymization on the XXXX website (VWA ./50, see
Point II.2). As a result, BF2 was instructed to use all of the XXXX -Analytics-

Properties collected data immediately delete. The BF2 have the deletion meanwhile

confirmed (VWA ./49, ./52 and ./53 see point II.2). Due to the deletion made
process neither the MB nor the BF2 data of the BF1. It will therefore be in accordance with Section 24 (6) DSG

encouraged the informal termination of the proceedings. The statement of the MB was the BF1

submitted for information (VWA ./51, see point II.2).

I.14. In the submission of July 9th, 2021 (VWA ./54, see point II.2), the BF2 stated that the
Appropriateness assessment according to the recommendations 01/2020 for supplementary measures

of transmission tools to ensure the level of protection under Union law for

personal data, version 2.0 of the European Data Protection Board (“EDPB-
Recommendations”) is not limited to examining the legislation of the third country.

It must also include any specific circumstances surrounding the transfer in question

be taken into account. In the present case, the processed personal data
To treat data differently than that due to the limited nature and low sensitivity

Data that are the subject of the Schrems I and Schrems II judgments. This is for him

relevant to the case at hand. As a result, the European Data Protection Board
a risk-taking approach is recommended.

They also include the actual probability of official access to the data

relevant factor for the adequacy assessment. Even in the presence of more problematic

Legislation may allow the data transfer to continue (even without
Implementation of additional measures) if the exporter has no reason to believe

that the problematic legislation was interpreted and/or applied in practice

could be that they are the transferred data and the specific data importer
In addition, the assessment is no longer exclusively based on the legislation of

third country, but also the question of whether or not this is applied in practice

not. For example, the white paper “Information on U.S. Privacy Safeguards Relevant to SCCs
and Other EU Legal Basis for EU-U.S. Data Transfers after Schrems ll" that the

most companies operating in the EU do not process data required for US
secret services are of interest.


When a data exporter transfers personal data in a way that the
personal data without the combination with other data no longer one - 14 -


can be assigned to a specific data subject, according to the EDSA
Recommendations that the pseudonymization carried out is an effective supplementary measure.

It is not to be expected that US authorities will have additional information that

would allow them to be stored behind the first party cookie values _gid and cid, respectively
to identify data subjects who have an IP address.


Finally, the BF1 did not apply for a finding that his rights in the
been injured in the past.

I.15. In its statement of 09.07.2021 (VWA ./55, see point II.2) the BF1 stated,

that personal data is being processed. This is through the

submitted documents (VWA ./5 and VWA ./34, point 5.3) have been verified. Also would
Contract documents (order data processing conditions or

Standard data protection clauses) do not create a personal reference, but these are

Documents an important indication that both the BF2 and the MB of a
Personal reference would go out. The BF2 itself also assumes that the

BF1 off. If it is ultimately for the identification of a website visitor only requirement

be whether he makes a certain declaration of intent in his XXXX account (such as the
Activation of "Ad personalisation"), for the BF2 all possibilities of

identifiability exist. Otherwise, the BF2 can in the account settings
expressed wishes of a user for "personalization" of the received

Promotional information does not match.

The universally unique identifier (UUID) in the _gid cookie with the UNIX timestamp

1597223478 is set on Wednesday 12 August 2020 at 11:11 and 18 seconds CET

those in the cid cookie with UNIX timestamp 1597394734 on Friday 14 August
2020 at 10:45 and 34 seconds CET. It follows that these cookies were already in place before

were used for the visit that is the subject of the complaint and also a longer-term one
tracking has taken place. To his knowledge, the BF1 does not have these cookies either

immediately deleted and the website XXXX also visited repeatedly.

The BF2 misjudges the broad understanding of the GDPR when assessing its existence

personal data. The specific IP address used is also no longer available for the BF1

detectable. However, this is irrelevant, since the UUID in the cookies gives a clear indication anyway
personal reference exists. Specifically allow the combination of cookie data and IP address

Tracking and evaluation of geographic localization, internet connection and context
of the visitor, which can be linked to the cookie data already described. For this

but would also include data such as the browser used, the screen resolution or the

operating system (“device fingerprinting”). - 15 -


In the context of the complaint, it is more relevant that US authorities are responsible for secret services
easily ascertainable data, such as IP address, as a starting point for monitoring

would use by individuals. It is the standard procedure for secret services to

to 'hang on' from one date to another. When the BF1's computer is about always
appears again on the Internet via the IP address of XXXX, this can be used

to spy on the work of the XXXX club and to target the BF1. in one

In a further step, other identifiers would then be searched for in the data, such as the ones mentioned
UUIDs, which in turn are an identification of the individual person for a surveillance

allow other places. The US secret services are in this context

thus an "other person" within the meaning of Recital 26 GDPR. The BF1 works
not only for XXXX , but also have a relevant role as a model complainant in

these efforts. Thus, according to US law, monitoring of BF1 according to 50 USC §

1881a (as well as by all other persons entrusted with this complaint) at any time
legally possible. Even with the application of the supposed "risk-based approach".

This case is a prime example of high risk.

The e-mail address XXXX is assigned to BF1, who until his marriage

Surname "XXXX". However, the old XXXX account is still in use.
The BF2 have not explained to what extent the undisputed data are linked, evaluated

or the result of an evaluation is simply not displayed to the user.

In addition, Chapter V GDPR does not recognize a "risk-based approach". This can only be found

in certain articles of the GDPR, such as in Art. 32 leg.cit. The new
Standard contractual clauses in the Implementing Decision (EU) 2021/914 are for the

Facts not relevant due to lack of temporal validity. A "transmission" is not

unilateral action of a data exporter, every "transfer" also requires one
receiving the data. Accordingly, Chapter V of the GDPR is also applicable to BF2, it

is a joint action by data exporter and importer.

If the BF2 has not violated Art. 44 ff GDPR, the provisions according to Art.

28 Para. 3 lit. a and Art. 29 GDPR to be taken into account as a "catch-all rule". Bar the BF2
following a corresponding instruction of a US secret service, he hits the

Decision, personal data about the specific order of the MB according to Art. 28

and Art. 29 GDPR and the corresponding contractual documents.
As a result, BF2 itself becomes the controller in accordance with Art. 28 (10) GDPR.

As a result, BF2 is also entitled to the provisions of Art. 5 et seq. GDPR

follow. A clandestine disclosure of data to US intelligence agencies under US law - 16 -


be without a doubt not with Art. 5 Para. 1 lit. f GDPR, Art. 5 Para. 1 lit. a GDPR and Art
compatible.


I.16. After being asked to comment (VWA ./56, see point II.2), BF2 took the lead
their submission of August 12, 2021 (VWA ./57, see point II.2) that the BF1 his

I have not shown any legitimacy to lodge a complaint. He has no part of the

BF2 raised questions about the identifiability of his person based on the IP address
answered. Regarding the _gid number and cid number, it should be noted that no

directory is available in order to make the BF2 identifiable. The fact that
in ErwGr 26 GDPR the "separation" is mentioned as a possible means of identification,

however, do not change the understanding of the words "identify" or "identification" or

“identifiability”.

The identifiability of the BF1 requires at least that his identification on

The basis of the data in question and with means that are possible according to general
discretion would likely be used. This has not been established and cannot

assumed and, on the contrary, improbable, if not impossible.

Also the fact that the BF2 contract data processing conditions are completed
have, does not mean that the data that are the subject of this procedure are different

personal data, nor that it is the data of BF1.

BF1's view that the data transfer should not be based on a risk-based approach

evaluate ("all or nothing"), do not follow. This is not consistent with the
GDPR and adhere to Recital 20 of the Implementing Decision (EU) 2021/914 of the European

see commission. This is also due to the different versions of the EDSA

Recommendation recognizable. Even if access to the above numbers by US
Authorities "legally" possible at any time, should be checked how likely this is. The BF1

have not provided any convincing arguments as to why or how the "cookie
Data” related to his visit to a publicly accessible, and by many

Austrian website used, such as the one in question, “Foreign Intelligence

Information" and thus to the goal of purpose-restricted data collection according to § 702
could become.


I.17. With the decision that is the subject of the proceedings (VWA ./59, see point II.2), the BA remedied
Point 1. first the notice of 02.10.2020, Zl 2020-0.527.385 (DSB-D155.027)

(see point I.2).

With point 2, the BA upheld the complaint against the MB and found that (a)

the MB as responsible by implementing the tool "XXXX -Analytics" on their - 17 -


Website under XXXX at least on August 14, 2020 personal data of BF1 (this
are at least unique user identification numbers, IP address and

browser parameters) to the BF2, (b) the standard data protection clauses that the

MB concluded with the BF2, no adequate level of protection according to Art. 44 DSGVO
would offer, since (i) the BF2 as a provider of electronic communication services within the meaning

from 50 US code § 1881(b)(4) and as such subject to surveillance by U.S.

Intelligence agencies under 50 U.S. Code § 1881a (“FISA 702”), and (ii) the actions,
in addition to the standard data protection clauses mentioned in clause 2. b).

were not effective, as these are the monitoring and

would not eliminate access opportunities by US intelligence services and (c) in
present case no other instrument according to Chapter V of the GDPR for the in Spruchpunkt

(2.a) mentioned data transmission can be used and the MB therefore for the

in the context of the data transfer mentioned in point 2.a) no appropriate
have guaranteed a level of protection in accordance with Art. 44 GDPR.

With point 3. the bB rejected the complaint because of a violation of the general

Principles of data transmission in accordance with Art. 44 GDPR against BF2.

In its legal justification, the bB first deals with its competence and its

Determination competency (see point II.3.4) apart. She also describes that Art.
44 DSGVO as a subjective right (see point II.3.4). In connection with

Paragraph 2.led the construction that the transmitted data (see point II.1.3 or II.1.3.1)

at least in combination, personal data according to Art. 4 Z 1 DSGVO. For the
lack of an appropriate level of protection in accordance with Art. 44 GDPR, the bB stated that the

European Court of Justice the "EU-US Privacy Shield" with the decision of July 16, 2020, C-

311/18 (Schrems II) declared invalid. The subject of the proceedings could also
Data transmission not only on the completed between the MB and the BF2

Standard data protection clauses in accordance with Article 46 (2) (c) GDPR are supported. also be

the additional measures identified by the BF2 are not suitable in the judgment
identified gaps in legal protection - inappropriate access and

Surveillance capabilities of US intelligence services and insufficient effective

Legal remedy for those affected – to close.

The rejection in point 3. justified the bB with the fact that the requirements of Art.
44 GDPR to which BF2 would not apply. The BF2 lay the personal data of

BF1 not open, just keep it. The requirements of Chapter V GDPR are dated

data exporter and not also by a data importer (in a third country). - 18 -


The notification was delivered to BF1 on January 12th, 2022, to BF2 and MB on January 13th
point 3 of the decision, the BF1 lodged a complaint on February 7th, 2022

(see point I.20). On February 9th, 2022, the BF2 filed a complaint against point 2 of the decision

Complaint (see point I.17I.18). The MB did not
complaint.


I.18. In its complaint (VWA ./62, see point II.2) the BF2 first gave reasons
their right to complain. Furthermore, BF2 stated that between the subject matter of

contested partial decision and the subject matter of the planned second decision
Partial notice of no separability according to § 59 paragraph 1 AVG. There is also a violation

of a data subject's right. In addition, a finding of alleged, in the

Past lying, injuries are not made. Also lie one
Class action entitlement according to Art. 80 Para. 2 GDPR does not exist.


Contrary to the view of the BB, the data at issue in the proceedings are not
personal i.S.d. GDPR. The BF2 explained that from the

processed data is not related to a natural person. According to the

Case law of the European Court of Justice (ECJ December 20, 2017, C-434/16 (Nowak), Rn
35) there is neither a content element, a purpose element nor a result element. Further

there is no identifiability of a natural person. From the specified IP
address, the XXXX -specific random numbers, the browser parameters and the page

A specific person cannot be identified from the data obtained. Also from one

Combination of this data is not possible identification. Furthermore, the BF2 has none
technical possibilities to identify the BF1 via his XXXX account.


BF2 also emphasized a risk-based approach. Even if you
subject to the proceedings a personal reference, so is under

Consideration of the low threshold of the transmitted data and the very
low basis risk, the inapplicability of and the fact that FISA 702 anyway

no practical application, no disclosure of data according to EO 12.333.

Since extensive supplementary measures had been implemented, a
appropriate level of protection for the procedural transmission of the data more

as given and these are permissible according to Art. 44 ff DSGVO.

In its complaint, BF2 enclosed the cookies and user identification (VWA

./63, see point II.2),Linker (VWA ./64, see point II.2),Report from XXXX (VWA ./65, see
Point II.2) and New EU-US data transfer framework (VWA ./66, see point II.2). - 19 -


I.19. In the statement (VWA ./67, see
Point II.2) in the course of the filing that the BF2 had no legitimacy to lodge a complaint, since

since the end of April 2021 the product XXXX -Analytics is now offered by XXXX. Also

the bB explained that it has a determination competence in complaint procedures because of
alleged violations of the DSG or the GDPR.


Furthermore, the DA stated that the BF2 was obviously involved in an agreement itself
personal data. This can be recognized by the fact that the BF2 with the MB

undisputedly a processor agreement in accordance with Art. 28 Para. 2 GDPR and a
Standard data protection clause according to Art. 46 Para. 2 lit. cDSGVO

the BF2 stated that a website operator in all cases standard data protection clauses

finish with the BF2 (VWA ./31, page 3). Also declare the BF2 itself that online
Labels are personal data (see point II.1.3.6). Irrespective of

these declarations or behavior of BF2 would be the subject of the proceedings

Consideration of the case law of the European Court of Justice and explanations of the
European data protection officer (VWA./68) personal data available. Also

In the present case, an assignment can be made via the IP address.

In addition, a combination can also be made with browser information. In
In this context, the DA referred to the definition of "fingerprinting": This is a

Process by which an observer connects a device or application instance with sufficient

Probability based on multiple pieces of information.

Finally, the BA extensively refuted the demonstrated risk-based approach of BF2 and
pointed out that economic interests played no role in the decision of the

European Court of Justice on July 16, 2020, C-311/18 (Schrems II).

His opinion presented the bB a decision of the European

Data protection officer of January 5th, 2022 (VWA ./68, see point II.2), a decision
of the LG Munich (VWA ./69, see point II.2), an expert opinion on the current status of the US

Surveillance law (VWA ./70, see point II.2) and essential findings of the report

on the current status of US surveillance law (VWA ./71, see point II.2).

I.20. In his complaint (VWA ./60, see point II.2) the BF1 stated that the

bB the rejection in point 3. with a misinterpretation of the word Art. 44
justify GDPR. As far as the bB justify their rejection with the fact that the BF2 as recipient

of personal data in the third country United States (data importer) the data
do not disclose it, but (only) receive it, the DA misunderstands that Art. 44 GDPR uses the term

Don't use "disclosure". Art. 44 GDPR uses the term "transfer". The

The distinction between these terms is objectively decisive: in contrast to - 20 -


a “disclosure” that can also occur without a designated recipient (e.g
by publication on a website) require a "submission" (or a

"Disclosure by transmission") namely always a recipient and also his

(at least minimal) assistance. While a "disclosure" with the act of
"Making available" has been completed, a "transmission" also requires one

Receipt by the recipient.

From a legal point of view, the design of Chapter V GDPR clarifies the technical one

Reality (meaning that for the transmission on the Internet there is always an interaction of a
transmitter and a receiver is required). Already Art. 44 GDPR generally requires

"Controller and the Processor" compliance with the provisions of the

chapter, without referring to the "person responsible for exporting the data or
order processor”. Also the guarantees mentioned in Art. 46(2) GDPR

consistently require cooperation between data exporter and data importer and

include in particular the obligations of the data importer. rightly be
also here both the data exporter and the data importer to comply with the

The provisions mentioned are obligatory, as they jointly transfer data out of the EU into the

third country and from the third country to the EU.

It should also be noted that obligations from the standard contractual clauses
(Implementing decision of the European Commission 2010/87/EU of February 5, 2010

about standard contractual clauses for the transfer of personal data

Processors in third countries according to Directive 95/46/EG of the European Parliament
and of the Council) for the data importer. Clause 3(2) clearly contains

a subsidiary obligation of the data importer, clauses 5(a) to (e), 6, 7, 8(2) and 9

to 12 to comply with the standard contractual clauses given to the data subject if the
company of the data exporter no longer exists in fact or in law and no

legal successor has assumed the obligations of the data exporter. Would Chapter V

GDPR not also applicable to the data importer would be the enforcement of the
subjective rights of the person concerned from the standard contractual clauses towards the

Data importer impossible.

I.21. In the statement (VWA ./61, see

Point II.2) in the course of the filing that it was correct from a technical point of view that a
Transmission (unlike disclosure to an indefinite group of addressees, e.g. in

form of publication on a website) assume that there is a recipient.

However, as already stated in the contested decision, one
Processing operation (here both "transmission") different from a legal point of view - 21 -


Duties and degrees of responsibility result (VWA ./59, page 40). In line with the
"Guidelines 5/2021 of the EDPB on the relationship between the scope of Art.3 and

the specifications for international data traffic in accordance with Chapter V GDPR” go the bB

assumes that the data importer does not have the legal obligation to comply with the requirements
of Art. 44 GDPR.


Finally, it should be noted that the data importer naturally also receives the corresponding
duties would meet. In the case of the conclusion of standard contractual clauses according to Art. 46

Paragraph 2 lit. c GDPR, a data importer has all contractual obligations
to be complied with, which had been concluded between the latter and his contractual partner.

However, these obligations are of a contractual nature. On the other hand, (only) the

Data exporter to comply with the obligations under Art. 44 GDPR, which also includes that
a suitable instrument - such as the conclusion of standard contractual clauses -

is in place to ensure an adequate level of protection.

I.22. With a submission dated July 8th, 2022, BF2 sent a reply to the complaint

of BF1 (OZ 4 to W245 2252208-1). In it, BF2 explained in detail that Art. 44 ff

GDPR is not applicable to XXXX as a data importer.

I.23. In its statement of January 13, 2022 (OZ 4 to W245 2252208-1), the BF2 referred
repeatedly points out that the subject of the proceedings is processing personal data

had been. In addition, the BF2 explained that Art. 44 ff GDPR requires a risk-based approach

is not to be taken.Furthermore, the BF2 explained with more justification that the BF1
as a data importer is directly covered by Chapter V GDPR.

I.24. With a statement dated February 14, 2023 (OZ 15 to W245 2252208-1), BF2 stated that

there is a binding effect on the basis of the asserted statements. In particular,

that the verdict stated that personal data had been transferred
are, have obvious effects on further proceedings at the bB. The BF2 could

not refute this fact in further proceedings.

With regard to personal reference, BF2 repeatedly stated that this was not available

also submitted two affidavits to prove that the BF2 is not in
was able to access MB's website via BF1's XXXX account

prove. It is also legally required to take a risk-based approach into account.

I.25. In preparation for the complaint hearing, the bB (OZ 23 to W245

2252208-1), the BF1 (OZ 24 to W245 2252208-1) and BF2 (OZ 25 to W245 2252208-1)
Observations. In these observations, the parties reiterated their positions so far in the proceedings

represented points of view. - 22 -


I.26. In the case at hand, the BVwG conducted a public
Oral hearing attended by the BF1 in the presence of his authorized representative

attended personally. A representative of the BA and BF2 also took part in the hearing.

After the conclusion of the oral hearing, an oral announcement of the
knowledge. The BF1 and the BF2 requested the BVwG in writing within the deadline

Execution of the orally announced knowledge.


II. The Federal Administrative Court considered:

II.1. Findings:

The facts relevant to the decision are clear.

II.1.1. About the procedure:

The course of the procedure presented under point I is determined and the decision made
laid the foundation.


II.1.2. About the owner of the website XXXX :
The XXXX has the website XXXX as part of an asset deal with effect from 02/01/2021

transferred to XXXX , Munich. The XXXX was then renamed to XXXX.

Until August 2021, XXXX continued to manage on behalf of and under the direction of XXXX,

Munich the website XXXX .

In August 2021, the XXXX website was completely transferred to the IT environment
the XXXX Munich. After the transfer, XXXX -Analytics will be preceded by a

Proxy server used. This even allows the IP addresses to be transmitted to the BF2

completely prevented.

II.1.3. For the data processing that is the subject of the procedure:

The BF1 visited the MB XXXX website at least on August 14, 2020, at 10:45 a.m.

In the transaction between the browser of the BF1 and https://tracking. XXXX were born on 14.
August 2020 at 12:46:19.344 CET unique user identification numbers at least

set in the “_ga” and “_gid” cookies. As a result, these identification numbers on August 14

2020 at 12:46:19.948 CET to https://www. XXXX -analytics.com/ and thus to the BF2
transmitted.

Specifically, the following user identification numbers, which are in the browser of the BF1

are transmitted to the BF2 (same values, each in different transactions

occurred are shown in italics or marked in orange and green):

           Domain Name Value Purpose - 23 -



 https://tracXXXX. _ga GA1.2.1284433117.1597223478 XXXX
                                                                             Analytics

 https://tracXXXX. _gid GA1.2.929316258.1597394734 XXXX
                                                                             Analytics

                                           ID=d77676ed5b074d05:T=1597223569: XXXX
 https://tracXXXX. _gads S=ALNI_MZcJ9EjC13lsaY1Sn8Qu5ovyKMhPw
                                                                             Advertising
                                                                              XXXX
 https://wwXXXX-analytics.com/gid 929316258.1597394734
                                                                             Analytics
                                                                              XXXX
 https://wwXXXX-analytics.com/id 1284433117.1597223478
                                                                             Analytics

These identification numbers each contain a preceding random number and a trailing one

UNIX timestamp showing when each cookie was set. The

Identifier in the _gid cookie with UNIX timestamp "1597394734" was set on Wednesday,

August 14, 2020 at 11:11 and 18 seconds CET, those in the cid cookie with the UNIX
Timestamp "1597223478" on Friday 12 August 2020 at 10:45 and 34 seconds CET.


With the help of these identification numbers it is possible for the BF2 to differentiate between website visitors

and also to get the information whether it is a new one or an old one
returning website visitors from www. XXXX trades. However, a website

Comprehensive analysis of behavior based on this key figure is not possible.


In addition, the following information (parameters) about the
BF1 browser in the course of requests to https://www. XXXX -

analytics.com/collect transmitted to the BF2 (excerpt from the HAR file, request URL

https://www. XXXX -analytics.com/collect, request excerpt with timestamp 2020-08-

14T10:46:19.924+02:00):

general

     Request URL https://www. XXXX-analytics.com/collect

     Request Method GET


     HTTP Version HTTP/2

Remote Address XXXX
headers

     Accept: image/webp,*/*

     Accept encoding: gzip, deflate, br

     Accept-Language: en-US,de;q=0.7,en;q=0.3


     Connection: keep alive - 24 -


     Host: www. XXXX-analytics.com

     Referer: https://www. XXXX .at/

     TE: Trailers

     User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101
       Firefox/79.0

Query Arguments

     _gid: 929316258.1597394734

     _s: 1

     _u: QACAAEAB~

     _v: j83

     a: 443943525

     cid: 1284433117.1597223478

     de: UTF-8

    dl: https://www. XXXX .at/

dt: XXXX .at Home - XXXX
    ea: /

     ec: scroll depth

     el: 25

     gjid:

     gtm: 2wg871PHBM94Q

     each: 0

     jid:

     ni: 0
     sd: 24-bit

     sr: 1280x1024

     t: event

     tid: UA-259349-1

     ul: en-us

     v: 1

     vp: 1263x882

     z: 1764878454 - 25 -


Size

     Headers 677 bytes

     Body 0 bytes

     Total 677 bytes

These parameters can therefore be used to draw conclusions about the browser used
Browser settings, language selection, the website visited, the color depth, the

Screen resolution and the AdSense linking number are drawn.

The remote address XXXX is that of the BF2.

The IP address of the BF1 device is sent to https://www. XXXX -

analytics.com/collect transmitted to BF2. The IP address became the subject of the proceedings
of BF1 transmitted to BF2.


The BF1 worked in the home office on August 14th, 2020. In the home office, the BF2 uses one
Screen with a resolution of 1280x1024 (sr value). In addition, the visible part

of the web window transmits a size of 1263x882 (vp value).

II.1.3.1. For a summary of the information that was published on August 14th, 2020

         were transmitted to BF2:
As a result of the implementation of the XXXX -Analytics tool, on 08/14/2020 -

summarized - the following information from the browser of the BF1, which is the website XXXX

visited, transmitted to the servers of BF2:

 unique online identifiers (uniqueidentifier) that identify both the browser and the device
    of the BF1 as well as the MB (through the XXXX analytics account ID of the MB as

    identify website operator);

 the address and HTML title of the website and the sub-pages visited by the BF1

    has;

 Information about the browser, operating system, screen resolution, language selection and

    date and time of website visit;

 the IP address of the device that the BF1 used.

II.1.3.2. For information on the cookies used:

For Universal Analytics, the JavaScript library analytics.js or the JavaScript
library gtag.js are used. In both cases, the libraries use first-party-

Cookies to:

     Distinguish unique users and - 26 -



     Throttle the request rate

When using the recommended JavaScript snippet, cookies on the

highest possible domain level. If their website address for example

blog.example.co.uk, analytics.js and gtag.js set the cookie domain

at.example.co.uk. Setting cookies at the highest possible domain level
allows measurement across subdomains without requiring any additional configuration

is required.


Note: gtag.js and analytics.js do not require cookies to be set to send data to XXXX -
transmit analytics.


gtag.js and analytics.js set the following cookies:

  Cookie name Default expiry time Description

 _ga 2 years Used to distinguish users.
 _gid 24 hours Used to distinguish users.

 _gat 1 minute Used to throttle request rate. WXXXX

                                             Analytics is used via the XXXX Tag Manager
                                             named this cookie _dc_gtm_<property-id>.

 AMP_TOKEN 30 seconds to 1 year Contains a token used to retrieve a client ID from the AMP client
                                             ID service can be used. Show other possible values

                                             Optout, inflight request, or an error retrieving an
                                             Client ID from AMP Client ID service.
 _gac_<property-id> 90 days Contains campaign-related information for the user.

                                             If you linked yourXXXX Analytics andXXXX Ads accounts

                                             have the Website Conversion TagXXXXn Ads read this
                                             Cookie unless you opt out.


II.1.3.3. To link to the BF1's XXXX account:
During the visit to the XXXX website, the BF1 was logged into his XXXX account,

which is linked to the email address XXXX. This email address belongs to BF1.


A XXXX account is a user account used for authentication

at various XXXX online services that BF2 serves. A XXXX account is something like this
Prerequisite for the use of services such as " XXXX " or " XXXX Drive" (a file hosting

Service).


On August 14, 2020, the web & app activities were set in the XXXX account of BF1 ( XXXX ).
activated. However, the BF1's XXXX account has opted not to record activities from

Include websites that use XXXX services. - 27 -


Contrary to BF2's own statements, it is technically able to provide the information
get that a specific XXXX account user visited the XXXX website (on the XXXX -

Analytics is implemented) if this XXXX account user during the

was logged into the XXXX account when visiting the XXXX website.

Metadata from XXXX applications (such as from XXXX account) that the BF1 on 08/14/2020

used was stored on servers in the United States.

II.1.3.4. For (non)anonymized processing of the IP address of the BF1:
The IP anonymization function on the MB XXXX website was faulty

implemented. This did not ensure that on August 14, 2020 after transmission

of data to which BF2 the IP address was anonymized.

II.1.3.5. Regarding the deleted information:
The MB has instructed the BF2 in the course of the administrative procedure, all over

Delete the XXXX -Analytics Properties collected data for the XXXX website. The BF2

performed the deletion.

II.1.3.6. For the declaration of personal data by BF2:

On the page "Data processing terms for XXXX advertising products: Information on
the services", BF2 states that as part of the order processing service, "XXXX

Analytics" the data "online identifiers (including cookie identifiers), internet
Protocol addresses and device identifiers and identifiers assigned by the customer"

can be personal data.

II.1.4. About the web analysis service XXXX -Analytics:

 XXXX -Analytics is a measurement service that allows customers to track traffic to properties

measure, including traffic from visitors visiting a website owner's website
visit. Web analytics services are a popular category of services used by several

Providers are offered and are considered an essential tool for running a
site.


Website owners rely on web analytics services like XXXX Analytics to help them
help to understand how website visitors interact with their website and services

to interact. XXXX -Analytics helps them to create more engaging content and the

Monitor and maintain the stability of their websites.

In addition, website owners can set up dashboards that provide an overview of reports
and give metrics that customers care about the most, e.g. in real time the number of

Monitor visitors on a website. XXXX -Analytics can also help determine effectiveness - 28 -


from advertising campaigns run by website owners on XXXX ad services
measure and optimize.


All data collected by XXXX Analytics is hosted in the United States
(saved and processed).

II.1.5. About the implementation and functionality of XXXX -Analytics:

The web analytics service XXXX -Analytics becomes a

JavaScript codes embedded on the website owner's side. If user one
View a page on the website, this JavaScript code refers to a previous one on the device

user's downloaded JavaScript file which then enables tracking operation for XXXX -

runs analytics. The tracking operation retrieves data about the page request
various means and sends this information to via a list of parameters

the analytics servers connected to a single pixel GIF image request.

The data that XXXX -Analytics collects on behalf of the website owner comes from these

Sources:

     The user's HTTP request

     Browser/System Information

     First party cookies

An HTTP request for each web page contains details about the browser and computer,

who makes the request, such as host name, browser type, referrer and language. Over and beyond

Most browsers' Document Object Model (DOM) provides access to more detailed
Browser and system information, such as Java and Flash support and

screen resolution. XXXX -Analytics uses this information. XXXX -Analytics sets and

also reads first-party cookies on a user's browsers, which measure the
Allow user session and other information from page request.

When all this information is collected, it is sent to the analytics servers in the form

a long list of parameters sent to a single GIF image request to the

Domain XXXX-analytics.com. The data contained in the GIF request is
the data that is sent to the XXXX Analytics servers, which then further processes

and end up in the reports of the website owner.

II.1.6. To embed the program code for XXXX -Analytics on the XXXX website

       Associates:
Due to a decision by the MB, the program code for XXXX -Analytics was stored on their

site embedded. - 29 -


By configuring the tags or activating or deactivating various XXXX -
Analytics functions through the user interface determined the use of the MB

collected data. For example, the MB could set the retention period for data

specify, instruct that the IP address be anonymized after receipt by BF2,
determine who is allowed to receive data, etc.


II.1.7. The legal basis for the use of XXXX -Analytics by the participants:
The use of XXXX -Analytics requires a contract.

The MB and BF2 have an agreement entitled “Order data processing conditions

for XXXX advertising products”. This contract had the version dated August 12, 2020

(VWA ./18) valid at least on August 14, 2020. The contract regulates
Order data processing conditions for XXXX advertising products. It applies to them

Provision of data processing services and related thereto

technical support services for customers (MB) of BF2. The MB used the free one
Version of XXXX -Analytics.

The web analysis service XXXX -Analytics falls under the scope of the

"Order data processing conditions for XXXX advertising products".

With regard to the order data processing conditions for XXXX advertising products

in connection with the web analysis service XXXX -Analytics online identifiers
(including cookie identifiers), internet protocol addresses and device identifiers as well

Labels assigned by the customer Personal data of the customer (MB)

represent.

In addition, these order data processing conditions in point 10.2. the application

of standard data protection clauses before a transmission of personal
Customer data is transferred from the EEA to a third country that is not one

adequacy decision under European data protection legislation.
Based on this, MB and BF2 signed a second contract on August 12th, 2020 with the

Title "XXXXAdsDataProcessingTerms:ModelContractClauses,StandardContractualClauses

for Processors” (VWA./22). These are standard contractual clauses
for international data traffic (based on an implementation decision of the

European Commission 2010/87/EU of February 5, 2010 on Standard Contractual Clauses

for the transfer of personal data to processors in third countries
of Directive 95/46/EC of the European Parliament and of the Council, OJ L 2010/39, p. 5.).

In addition to implementing XXXX analytics, a website owner can

Share analytics data to XXXX by changing XXXX's data sharing setting - 30 -


products and services activated and the privacy policy for XXXX
Measurement Controller controllers that apply to the use of this setting,

accepted separately.

The data sharing setting has not been activated by the MB. Also, the MB XXXX

-Signal not on. The MB did not have its own authentication system and used

also no user ID function.

II.1.8. For the purpose of processing by the collaborators:
 XXXX -Analytics is used to perform the following general statistical evaluations about the

Enable website visitor behavior:

     Reach measurement (i.e. how many users access the site);

     Evaluation of which articles have the greatest traffic (i.e. which articles have the most

       were called),

     Average session duration,

     Evaluation of the average number of pages viewed per session

       become.

II.1.9. Regarding the measures taken by BF2 after the judgment of the European Court of Justice of

       07/16/2020 in Case C-311/18:

After the decision of the European Court of Justice, BF2 assumed that the verdict
also applies to the use of XXXX -Analytics by website owners. After the decision

of the European Court of Justice, the BF2 immediately began amending the
Data Processing Terms (DTPS) to replace the Standard Contractual Clauses (SCC) for

to make all affected contracts applicable. This included updating a

Variety of contracts, transmission of communications to website owners on
08/03/2020, the translations and the publication of the corresponding ones

Terms of Contract. These changes to the order data processing conditions

(DTPS) came into force on August 12, 2020.

Section 10 of the updated Order Data Processing Terms (DTPS) provides that
that, insofar as the storage and/or processing of personal data of customers,

including personal data in XXXX -Analytics data, the submission

personal data of customers from the EEA to a third country that is not one
subject to an adequacy decision under the GDPR, the website owner (as

data exporter) at XXXX (as data importer) for the transfer of personal

Data to processors in third countries who do not have adequate data protection - 31 -


ensure Standard Contractual Clauses (SCCs) are used. The Standard Contractual Clauses
(SCCs) are made available at XXXX. These Standard Contractual Clauses (SCCs)

would the European Commission in its Decision 2010/87/EU

comply with published clauses.

II.1.10.Regarding the additional measures that come with the introduction of the standard contractual clauses

       were set by the BF2:
The following measures were in place before the decision of the European Court of Justice

Case C-311/18 in force and therefore also existed during the period in which the
Conditions were updated by 08/12/2020. According to the statements of the BF2

these measures are suitable to ensure an adequate level of protection.

II.1.10.1.Legal and organizational measures:

The BF2 evaluates every request made by the state authorities for user data

receives to ensure they comply with applicable laws and XXXX policies.

BF2 notifies customers before any of their information is disclosed unless
unless such notice is prohibited by law or the request involves an emergency.


The BF2 publishes a transparency report.

The BF2 publishes its policy on dealing with government requests.

II.1.10.2.Technical measures:
BF2 uses robust technical measures to protect personal data during the

to protect transmission (default use of HTTP Strict Transport Security

(HSTS), encryption of data on one or more network layers (protection of the
Communication between XXXX services, protection of data in transit between

Data centers and protection of communications between users and websites)).

The BF2 uses robust technical measures to protect stored personal data

(The BF2 encrypts XXXX analytics data stored in their data centers
get saved; BF2 builds servers exclusively for their data centers and maintains them

an industry-leading security team, XXXX analytics data is only accessible to

employees who need the data for their work).

II.1.10.3. Pseudonymity of data from XXXX -Analytics:

The BF2 believes that the data for measurement by website owners
are personal data, they would have to be considered as pseudonymous. The BF2 is

of the opinion that if a third party accesses the XXXX -Analytics data, this - 32 -


will in principle not be able to identify the data subject on the basis of this data
identify.


II.1.10.4.Optional technical measure - IP anonymization:
In addition to the measures mentioned, website owners can use "IP anonymization"

use to instruct BF2 to delete all IP addresses immediately after collection

anonymize and thus contribute to data minimization. If this is used,
at no time the full IP address is written to disk, as all

Anonymization in memory occurs almost instantly after the request to the BF2
has been received.


II.1.11.The BF2 as an electronic communication service:
BF2 is a provider of electronic communications services within the meaning of Section 50 of the U.S. Code

1881(b)(4) and as such is subject to supervision by U.S.

Intelligence agencies under 50 U.S. Code § 1881a (“FISA 702”). The BF2 transmitted the US
Government personal information under U.S. Code § 1881a. It can be from the US

Government metadata and content data are requested.

II.2. Evidence assessment:

Evidence was collected through inspection of the administrative file of the bB [hereinafter referred to as "VWA"
with the components ./01 - data protection complaint of the BF1 from 08/18/2020 (see point

I.1), ./02 - Data protection complaint of the BF1 from August 18th, 2020 - Attachment -

XXXX Analytics Terms of Use (see point I.1), ./03 – Privacy Complaint
of the BF1 from 18.08.2020 - Supplement - Terms of Use for

Order data processing conditions for XXXX advertising products, version 01.01.2020

(see point I.1), ./04 - data protection complaint of the BF1 from August 18th, 2020 - enclosure -
Terms of Use for Order Data Processing Terms for XXXX

Advertising products, version 08/12/2020 (see point I.1),./05 - data protection complaint of the BF1
dated 08/18/2020 - Attachment - HAR data of the website visit (see point I.1), ./06 -

Data protection complaint of the BF1 from August 18th, 2020 - Enclosure - XXXX (see point I.1), ./07 -

Data protection complaint of the BF1 from August 18th, 2020 - attachment - certificate of representation (see
Point I.1), ./08 - Identification of lead responsibility (see point I.2), ./09 -

Decision of the BA regarding the suspension of the procedure (see point I.2), ./10 - request

the bB for the statement to the MB (see point I.2), ./11 - Statement of the MB from
December 16, 2020 (see point I.3), ./12 - Statement of the MB of December 16, 2020 - Enclosure -

Reports from the tool (see point I.3), ./13 - Statement of the MB from 16.12.2020 -

Enclosure - Information on IP anonymization (see point I.3), ./14 - Statement of
MB from December 16th, 2020 - Attachment - Screenshot of the set storage period (see point I.3), - 33 -


./15 - Statement of the MB of 16.12.2020 - Attachment - List of server locations (see
Point I.3), ./16 - Statement of the MB from 16.12.2020 - Enclosure -

Order data processing conditions for XXXX advertising products, version 08/16/2020

(see point I.3), ./17 - statement of the MB from 16.12.2020 - enclosure -
Order data processing conditions for XXXX advertising products, version 08/12/2020

(see point I.3), ./18 - statement of the MB from 16.12.2020 - enclosure -

Order data processing conditions for XXXX advertising products, version 01.01.2020
(see point I.3), ./19 - Statement of the MB from 16.12.2020 - Enclosure - Comparative version

AVV from January 1st, 2020 vs. August 12th, 2020 (see point I.3), ./20 - Statement of the MB from

12/16/2020 - Enclosure - Comparative version AVV from 08/12/2020 vs 08/16/2020 (see point I.3),
./21 - Statement of the MB from 16.12.2020 - Enclosure - Screenshot of settings (see

Point I.3), ./22 - Statement of the MB from 16.12.2020 - Enclosure -

Standard data protection clauses (see point I.3), ./23 - Statement of the MB of 16.12.2020
- Annex - Information on security measures (see point I.3), ./24 - Opinion

the MB from 16.12.2020 - Enclosure - List of processing activities for XXXX

Analytics (see point I.3), ./25 - Request from the bB for a statement to BF1 from
December 21, 2020 (see point I.4), ./26 – Opinion of the BF1 from January 22, 2021 (see point I.4),

./27 - Opinion of the BF1 from 22.01.2021 - Attachment - Third party in the cookie banner of
MB (see point I.4), ./28 - Opinion of the BF1 from 22.01.2021 - Attachment - Contacts of

XXXX with US server (see point I.4), ./29 - Opinion of BF1 from 01/22/2021 - Attachment

- Contacts of XXXX with US server, reference to fingerprint technology (see point I.4),./30
- Request of the bB for a statement to BF2 from February 26th, 2021 (see point I.5), ./31 -

Statement of the BF2 from April 9th, 2021 (see point I.5), ./32 - request of the bB to

Statement to BF1 and MB of April 14, 2021 (see point I.6), ./33 - statement of
MB from 05/04/2021 (see point I.7), ./34 - Statement of the BF1 from 05/05/2021 (see

Point I.8), ./35 - Opinion of the BF1 from May 5th, 2021 - Enclosure - XXXX -Analytics Cookie,

Use on website (see point I.8), ./36 - Opinion of BF1 from 05/05/2021 -
Enclosure - How XXXX uses cookies (see point I.8), ./37 - Opinion of the BF1 from

05/05/2021 - Attachment - Measurement Protocol Parameter Reference (see point I.8), ./38 -

Request of the bB for a statement to BF1 from 06.05.2021 (see point I.9), ./39 -
Request of the bB for a statement to BF2 from 06.05.2021 (see point I.9), ./40 -

Request of the bB for a statement to the MB of May 10th, 2021 (see point I.9),./41-application
BF2 to extend the deadline for comments from May 12, 2021 (see point I.9), ./42

– Granting of the requested extension of the deadline by the BB from May 14, 2021 (see point I.9),

./43 - Opinion of BF2 from May 14th, 2021 (see point I.10), ./44 - Request of the BA
on the statement to BF1 and MB of June 11, 2021 (see point I.11), ./45 - application of the BF1 - 34 -


on extension of the deadline for comments from June 11, 2021 (see point I.11), ./46 -
Request from the bB for a statement to the MB of June 16, 2021 (see point I.11), ./47 -

Statement of the MB (transfer) of June 18, 2021 (see point I.12), ./48 -

Statement of the MB (configuration error, deletion of data) from 06/18/2021 (see
Point I.13), ./49 - Statement of the MB (configuration error, deletion of data) from

06/18/2021 - Attachment - Notification of BF2 about the deletion of information (see point

I.13), ./50 - Statement of the MB (configuration error, deletion of data) from
06/18/2021 - Attachment - Presentation of the wrong and correct implementation of the

Anonymization function (see point I.13), ./51 - Transmission of the SO's opinion

(VWA ./48 to ./50) to BF1 (see point I.13), ./52 - notification from the MB of 06/24/2021 (see
Item I.13), ./53 - notification from the MB of 06/24/2021 - enclosure - confirmation of deletion

BF2 (see point I.13), ./54 - Statement of BF2 from 09.07.2021 (see point I.14), ./55

- Opinion of the BF1 from 09.07.2021 (see point I.15), ./56 - request of the bB to
Statement to BF1 from 22.07.2021 (see point I.16), ./57 - Statement from BF2 from

08/12/2021 (see point I.16),./58 - WebsiteEvidence Collection regarding the website of the MB,

./59 - Partial decision of the Federal Civil Service of December 22nd, 2021, delivered on January 12th and 13th, 2022 (see point
I.17), ./60 - Complaint by the BF1 from February 7th, 2022 (see point I.20), ./61 -

Statement of the bB on the complaint of the BF1 from February 15th, 2022, ./62 -
Complaint by the BF2 of February 9th, 2022 (see point I.18), ./63 - Complaint

the BF2 from 09.02.2022 - Enclosure - Cookies and User Identification (see point I.18), ./64 -

Complaint of the BF2 from 09.02.2022 - Attachment - Linker (see point I.18), ./65 -
Notice of complaint from the BF2 of 09.02.2022 - Enclosure - Report XXXX (see point I.18),./66

- Complaint of the BF2 from 09.02.2022 - Attachment - New EU-US data transfer

Framework (see point I.18), ./67 – Statement by the BA on the complaint by the BF2
from February 17th, 2022 (see point I.19), ./68 - Statement of the bB on the complaint of the

BF2 of 02/17/2022 - Attachment - Decision of the European Data Protection Supervisor

from 05.01.2022 (see point I.19), ./69 - Statement of the bB on the complaint of the
BF2 from February 17th, 2022 - Attachment - Decision of the LG Munich from February 20th, 2022 (see point

I.19),./70 - Opinion of the bB on the decision of the BF2 of 17.02.2022 - Attachment

– Opinion on the current status of US surveillance law (see point I.19) and ./71 –
Statement of the bB on the complaint of the BF2 from February 17th, 2022 - Attachment -

Key findings of the report on the current status of US surveillance law (see
Point I.19)] as well as in the court act of the BVwG (file components are with ordinal number,

marked "OZ" for short).

II.2.1. About the procedure: - 35 -


The above procedure results from the harmless and
undoubted file content of the submitted administrative file of the bB and the court file

of the BVwG.

II.2.2. To the owner of the website XXXX
The findings in this regard result without a doubt from the statement by the MB

from June 18, 2021 (VWA ./47).

II.2.3. For the data processing that is the subject of the procedure:

The findings in this regard result without a doubt from the findings of the
contested decision (VWA ./59, page 18 ff), the statement of the BF1 from May 5th, 2021

(VWA ./34) and the complaint by the BF2 (VWA ./62, page 6).

The determination that the IP address of BF1 is transmitted to BF2 in the course of the proceedings

was, results from the explanations of the BF1 or his representative in the

Complaints hearing. In this context, the representative of BF1
VPN solution shown is understandable and was subsequently used by the BF2 in the

Complaint hearing no longer in question. In addition, the BF1 on 14.08.2020

credibly worked in the home office. This follows from the credible statements of
BF1 that in 2020 he mainly worked in the home office due to the corona and

due to the use of a high/narrow monitor (negotiation protocol from
March 31, 2022, OZ 29 to W245 2252208, page 14). Sohin were pertinent statements

meet.

II.2.3.1. For a summary of the information that was published on August 14th, 2020

         were transmitted to BF2:

The pertinent findings result without a doubt from the explanations of the bB im
disputed decision (VWA ./59, page 27).

II.2.3.2. For information on the cookies used:

The findings in this regard result without a doubt from statements by the BF1 in the

administrative procedures (VWA ./05) and from the findings of the contested
decision (VWA ./59, page 15).

II.2.3.3. To link to the BF1's XXXX account:

The findings in this regard result without a doubt from the findings of the

contested decision (VWA ./59, page 18 ff) and the statement of the BF2 (VWA ./43,
page 10f).

In his statement of April 9th, 2021, the BF2 submitted in question 9 that he

only receives such information if certain conditions are met, such as - 36 -


such as the activation of specific settings in the XXXX account. He disproved this
BF1 or the bB in the process with the following comprehensible argument: If namely

a XXXX account user's request for "personalization" of the received

Advertising information can be met on the basis of a declaration of intent in the account, so
From a purely technical point of view, there is the possibility of obtaining information about the website visited

of the XXXX account user.

Irrespective of this, numerous metadata were available to BF2 on August 14, 2020 (OZ

25 to W2452252208-1, page 3), which is displayed when an application (e.g. XXXX account) is called up
be transmitted. At the time of the proceedings (08/14/2020) the BF1 also

used his XXXX account. With the metadata that is generated when using the XXXX account

were transmitted, was a link to the transmitted metadata in the course of the
XXXX (via XXXX -analytics) possible.


In addition, a link to the IP address was undoubtedly possible. The BF1 has on
08/14/2020 worked in the home office. In this context, the IP address was direct

transmitted by BF1 to BF2 (negotiation protocol of March 31, 2022, OZ 29 to W245

2252208, page 14). Since the BF1 visited the website XXXX (XXXX -Analytics)
If you were signed into the XXXX account at the same time, you can easily switch between these applications

a link can be established via the IP address. In both applications, the
IP address already transferred for technical reasons. Against this background, on

Reason for the transmission of the IP address via the XXXX -Analytics application

Personal reference to the XXXX account (or to the registration information of the BF1) established
become. Since the BF1 was working in the home office at that time and he lives alone,

only he could use the transmitted IP address.

Due to the easy linkability of metadata and IP address between the

individual applications ( XXXX -Account and XXXX -Analytics) can indisputably
Personal reference (login data for XXXX) can be established.


It was also found that metadata from XXXX applications (such as XXXX account)
were transferred to the United States, which the BF1 used on 08/14/2020

(Negotiation protocol from March 31, 2022, OZ 29 to W245 2252208, page 11 f).

II.2.3.4. For (non)anonymized processing of the IP address of the BF1:

The pertinent findings result without a doubt from the explanations of the MB in the
administrative procedures (VWA ./48)

II.2.3.5. About the deleted information: - 37 -


The pertinent findings result beyond doubt from the explanations of the MB and
the BF2 in administrative procedures (VWA ./48, ./49, ./50, ./52 and ./53).


II.2.3.6. For the declaration of personal data by BF2:
The relevant findings result from the explanations of the bB in the course of the

File template (VWA ./67, page 4) and from an inspection of the BF2 XXXX website

last accessed on March 26, 2023).

II.2.4. About the web analysis service XXXX -Analytics:
The pertinent findings result beyond doubt from explanations of the BF2 in the

administrative procedures (VWA ./31, page 4).

II.2.5. About the implementation and functionality of XXXX -Analytics:

The pertinent findings result beyond doubt from explanations of the BF2 in the
administrative procedures (VWA ./31, page 4 f).


II.2.6. To embed the program code for XXXX -Analytics on the XXXX website
       Associates:

The relevant findings result beyond doubt from the documents of the

submitted administrative act (VWA ./10, page 1 and VWA ./31, page 7 f)

II.2.7. The legal basis for the use of XXXX -Analytics by the participants:
The relevant findings result beyond doubt from the documents of the

submitted administrative act (VWA ./31, page 6).

II.2.8. For the purpose of processing by the collaborators:

The relevant findings result beyond doubt from the documents of the
submitted administrative act (VWA ./10, page 2, ./11, page 11, ./18, ./21, ./22 partial decision,

page 15 ff).

II.2.9. Regarding the measures taken by BF2 after the judgment of the European Court of Justice of

       07/16/2020 in Case C-311/18:
The pertinent findings result beyond doubt from explanations of the BF2 in the

administrative procedures (VWA ./31, page 21 f).

II.2.10.On the additional measures that come with the introduction of the standard contractual clauses

       were set by the BF2:

The pertinent findings result beyond doubt from explanations of the BF2 in the
administrative procedures (VWA ./31, page 24 ff and VWA ./43).

II.2.11.The BF2 as an electronic communication service: - 38 -


The findings in this regard result without a doubt from the expert opinion on
current status of US surveillance law and surveillance powers as well as from

the transparency report of BF2 XXXX last queried on 03/29/2023).

II.3. Legal assessment:

II.3.1. Regarding jurisdiction:

According to § 6 BVwGG, the Federal Administrative Court decides through a single judge, provided that

Federal or state laws do not provide for the decision to be made by senates.

The contested decision is based on a decision of the bB in accordance with Article 44 GDPR.
This matter is covered by Senate decisions in accordance with § 27 DSG.


The procedure of the administrative courts with the exception of the Federal Finance Court is through
the VwGVG, Federal Law Gazette I No. 33/2013 (§ 1 leg.cit.). According to § 58 Abs. 2 VwGVG stay

conflicting provisions in force at the time this

federal law already promulgated are in effect.

According to § 17 VwGVG, unless otherwise specified in this federal law,
Procedure for complaints according to Art. 130 Para. 1 B-VG with the provisions of the AVG

Exception of §§ 1 to 5 as well as part IV, the provisions of the Federal Fiscal Code

- BAO, Federal Law Gazette No. 194/1961, of the Agricultural Procedures Act - AgrVG, Federal Law Gazette No. 173/1950, and
of the Service Law Procedure Act 1984 – DVG, Federal Law Gazette No. 29/1984, and otherwise those

procedural provisions in federal or state laws mutatis mutandis

apply, which the authority in the proceedings before the administrative court
has applied or should have applied in previous proceedings.

According to § 28 para. 1 VwGVG, the administrative courts have the legal matter by cognition

to be dealt with if the complaint is not to be dismissed or the proceedings are to be discontinued.

According to para. 2 leg.cit. the administrative court has on complaints according to Art. 130 para. 1 no. 1
B-VG to decide in the matter itself, if

1. the relevant facts have been established or


2. the determination of the relevant facts by the administrative court itself
is in the interest of speed or associated with significant cost savings.

As stated above, the facts of the matter are relevant

based on the records. The Federal Administrative Court therefore has its own say in the matter

decide.

II.3.2. Regarding the legal situation in the present complaints procedure:
Art. 4 Z. 1 GDPR – Definitions – reads: - 39 -


For the purposes of this Regulation, the term means:
1.” any information relating to an identified or identifiable natural person

    (hereinafter "data subject"); as identifiable becomes a natural
    Person considered, directly or indirectly, in particular by means of assignment to a
    identifier such as a name, an identification number, location data, an online

    Identifier or one or more special characteristics expressing the
    physical, physiological, genetic, psychological, economic, cultural or

    social identity of that natural person can be identified;

Art. 44 GDPR – general principles of data transmission – reads:
Any transfer of personal data that is already being processed or after

be processed before it is transmitted to a third country or an international organization
is only permitted if the person responsible and the processor
Comply with the conditions laid down in Chapter and also the other provisions of these

regulation are complied with; this also applies to any further transmission
personal data from the relevant third country or the relevant

international organization to another third country or another international
Organization. All provisions of this chapter shall be applied to ensure that
the level of protection for natural persons guaranteed by this regulation

is undermined.

Art. 45 GDPR – Data transfer based on an adequacy decision –
reads in part:

(1) A transfer of personal data to a third country or an international
    Organization may be undertaken if the Commission has decided that the

    third country concerned, a territory or one or more specific sectors within it
    Third country or international organization concerned an adequate level of protection

    offers. Such data transmission does not require any special approval.
(2) When examining the adequacy of the required level of protection, the
    Commission the following in particular:

    a) the rule of law, respect for human rights and fundamental freedoms contained in
       the country or international organization concerned

       relevant legislation in force, both general and sectoral
       – also in relation to public safety, defence, national security and
       Criminal law and access by authorities to personal data - as well as the

       Application of this legislation, data protection regulations, professional rules and
       Security rules including onward transmission rules

       personal data to another third country or another international
       organization, jurisdiction, and effective and enforceable rights of
       data subject and effective administrative and judicial

       Remedies for data subjects whose personal data is transferred
       become, - 40 -


    b) the existence and effective functioning of one or more independent
       Supervisory authorities in the third country concerned or those of an international

       Organization is subject to and responsible for compliance with and enforcement of
       Data protection rules, including appropriate enforcement powers, for
       the support and advice of the persons concerned in the exercise of their

       rights and for cooperation with the supervisory authorities of the Member States
       are responsible, and

    c) those of the third country concerned or the international one concerned
       Organization entered into international commitments or others
       Obligations arising from legally binding agreements or instruments

       as well as from the participation of the third country or the international organization
       multilateral or regional systems, particularly in relation to protection

       result in personal data.
(3) After assessing the adequacy of the level of protection, the Commission may
    Ways of an implementing act decide that a third country, territory or a

    or several specific sectors in a third country or an international organization
    provide an adequate level of protection as referred to in paragraph 2 of this article.

    A mechanism for a periodic review is set out in the implementing act,
    which takes place at least every four years, at which all relevant
    developments in the third country or in the international organization

    will be carried. In the implementing act, the territorial and the sectoral
    Scope of application and, where applicable, those referred to in paragraph 2 letter b of the present

    Article-mentioned supervisory authority or supervisory authorities. The
    Implementing act shall be adopted in accordance with the examination procedure referred to in Article 93(2).
    enacted

Art. 46 GDPR – data transmission subject to suitable guarantees – reads

excerpts:

(1) If there is no decision pursuant to Article 45 paragraph 3, a person responsible or a
     Processor personal data to a third country or an international
     Organization only transmit if the controller or the processor

     has provided appropriate safeguards and provided the data subjects have enforceable ones
     Rights and effective remedies are available.

(2) The appropriate guarantees mentioned in paragraph 1 can, without a special
     approval of a supervisory authority would be required
    a) a legally binding and enforceable document between the authorities or

       public bodies
    b) Binding Corporate Rules pursuant to Article 47,

    c) standard data protection clauses adopted by the Commission in accordance with the examination procedure pursuant to
       Article 93 paragraph 2 are issued,
    d) standard data protection clauses adopted by a supervisory authority, issued by the

       have been approved by the Commission in accordance with the examination procedure set out in Article 93(2), - 41 -


    e) approved codes of conduct pursuant to Article 40 together with legally binding ones
       and enforceable obligations of the controller or the

       Processor in the third country to apply the appropriate guarantees,
       including in relation to the rights of data subjects, or

    (f) an approved certification mechanism in accordance with Article 42 together with
       legally binding and enforceable obligations of the controller or
       of the processor in the third country to apply the appropriate safeguards,

       including in relation to the rights of data subjects.

Art. 7 Charter of Fundamental Rights of the European Union - Respect for the private and
family life – reads:

Everyone has the right to respect for their private and family life, their home and

their communication.
Art. 8 Charter of Fundamental Rights of the European Union - Protection of personal data -

reads:

Every person has the right to protection of their personal data. This

Data may only be used in good faith for specified purposes and with the consent of

data subject or on another legitimate basis regulated by law
are processed. Every person has the right to information about the data collected about them

Obtain data and obtain rectification of data. Compliance with this

Regulations are monitored by an independent body.

Art. 47 Charter of Fundamental Rights of the European Union – Right to an effective remedy

and an impartial court – reads:

Any person whose rights or freedoms guaranteed by Union law is violated
have the right, subject to the conditions provided for in this article

to seek an effective remedy before a court. Every person has the right to

that their cause be established by an independent, impartial and previously established by law
court in a fair trial, heard publicly and within a reasonable time

is.Any person can consult, defend and be represented. Persons who do not have

have sufficient funds, legal aid will be granted to the extent that this aid is necessary
is to ensure effective access to justice.


Recital 26 of the GDPR - No application to anonymized data - reads:
1Principles of data protection should apply to all information relating to a
                                                                 2
identified or identifiable natural person. A pseudonymization
subjected personal data obtained by using additional information
could be attributed to a natural person should be considered information about a

identifiable natural person. To determine whether a natural - 42 -


Person is identifiable, all means should be taken into account by that

controller or another person reasonably likely
be used to identify the natural person directly or indirectly, such as
                                4
for example, weeding out. In determining whether funds are discretionary
likely to be used to identify the individual should all
objective factors such as the cost of identification and the time required for it

Time expended, which is available at the time of processing
Technology and technological developments must be taken into account. The principles of

Data protection should therefore not apply to anonymous information, i.e. information
which do not relate to an identified or identifiable natural person, or

personal data that has been anonymized in a way that the data subject
person cannot or can no longer be identified. This regulation therefore does not apply

the processing of such anonymous data, including for statistical or research purposes.

GDPR Recital 30 – Online Identifiers for Profiling and Identification –
reads:

1Natural persons may be given online identifiers such as IP addresses and

Cookie identifiers that his device or software applications and tools or protocols
provide, or assigned other identifiers such as radio frequency identifiers. This can
Leave traces, especially in combination with unique identifiers and

other information received by the server can be used to profile the
create and identify natural persons.

II.3.3. Regarding the scope of Art. 44 ff GDPR:

If the following three requirements are met, there is a transfer and

Chapter V (Art. 44 ff) GDPR is applicable (Guidelines 05/2021 on the Interplay between the

application of Article 3 and the provisions on international transfers as per Chapter V of the
GDPR, version 2.0, adopted on 02/14/2023):

1) A controller or processor ("Exporter")

    is subject to the GDPR in the respective processing.

2) The exporter transmits personal data that are the subject of this processing

    are, to another controller, one common to the

    controller or a processor ("importer") or provides

    them available in other ways.

3) The importer is located in a third country, regardless of whether this importer

    for the respective processing pursuant to Article 3 of the GDPR or a
    international organization is.

Art. 8 para. 1 EU-GRC results in an obligation to perpetuate EU law

Protection levels (ECJ 06.10.2015, C-362/14 (Schrems), para. 72). The objective - 43 -


Provisions regulate the conditions, which allow a person responsible or

Allow processors (exporters) to transfer personal data to a third country
to transfer. The not legally defined term of transmission is within the scope of Art. 44 ff

to be understood in terms of protection. It therefore includes any disclosure of

personal data to a place outside the territory of the European Union
or to an international organization (Kuhling/Buchner, DSGVO BDSG, Art. 44, Rn 16,

Jahnel, Commentary on the General Data Protection Regulation Art. 44 GDPR (as of December 1st, 2020,

rdb.at), para. 18). From Art. 44 GDPR it follows that the importer (recipient in the third country)
is not covered by the scope of the standard because it does not cover the transmission

driven by data. The term "transmission" describes an action of the

data exporter, but not an action of the data importer. Furthermore, Art. 46 provides
Para. 1 GDPR that a person responsible or a processor personal

Data may only be transferred to a third country or an international organization if the

The person responsible or the processor has provided appropriate guarantees and if
enforceable rights and effective remedies for data subjects

stand. As a result, the clear wording of Art. 44 et seq

Requirements for data importers (also correctly the BF2, VWA ./43, page 19).
Based on the case law of the European Court of Justice, the data exporter bears the responsibility

Responsibilityforexaminingthepermissibilityofthespecifictransmission.Hemustatanytime
                                                                                        3
check whether the data is protected in the third country (Kuhling/Buchner, DSGVO BDSG,
Art. 44, para. 16 with reference to ECJ July 16, 2020, C-311/18 (Schrems II)). Total are off

Chapter V GDPR does not confer any subjective public rights/duties on a data importer

remove.

This must be distinguished, for example, from the contractual obligations of a data importer, e.g
Example that he must inform the data exporter immediately if the for

the law applicable to him no longer allows him to process the data in accordance with the

to store and process special contractual clauses (Commission decision of
05.02.2010 on standard contractual clauses for the transmission of personal data

Processors in third countries according to the Directive 95/46/EG of the European Parliament

and of the Council (2010/87/EU), Clause 5 - Obligations of the data importer). However, these are
not the subject of administrative/judicial proceedings.


II.3.4. On Art. 44 GDPR as a subjective right:
Repeatedly, the BF2 stated in the proceedings that a violation of Art. 44ff GDPR was not a

permissible object of a complaint according to Art. 77 GDPR (VWA ./54, page 6, VWA

./62, page 36). This view cannot be followed for the following reasons: - 44 -


§ 24 DSG grants the person whose basic personal right has been violated the opportunity

to have the violation of rights committed against her determined. The
The declaratory statement here concerns the legal position of a specific person in terms of their rights

injured person and is dogmatic in its scope of legal force for this infringement

limited. Based on this determination, the data subject should be able to
further individual claims - such as claims for damages - to pursue (VwGH

14.12.2021, Ro 2020/04/0032).

A dependency in that the data protection authority only

Infringement may be established if the data subject has a data subject right (Article 12ff GDPR)
claims cannot be derived from § 24 DSG. In connection with Art. 77

GDPR, the data protection authority is obliged to make a decision if the data subject

person believes that the processing of personal data concerning them
violates this regulation. Contrary to the view of BF2, however, Art. 77 GDPR is a

Restriction on affected rights according to Art. 12ffDSGVO not to be taken (e.g. VWA

./43, page 17). A data subject can base an infringement on any
Support the provision of the GDPR, if the GDPR-violating processing of personal

data also leads to a violation of the legal position of the person concerned (as does the

Predominant lesson: Jahnel, Commentary on the General Data Protection Regulation Art. 77 GDPR
(as of December 1, 2020, rdb.at), para. 11; Bergt in Kühling/Buchner, DSGVO BDSG, Art. 77, para. 10;

Körffer in Paal/Pauly, General Data Protection Regulation · Federal Data Protection Act, Art. 77;
                                                         4
Moos/Schefzig in Taeger/Gabel, DSGVO BDSG TTDSG, Art. 77, para. 9; Boehm in
Simitis | Hornung | Spiecker, data protection law, Art. 77, Rn6).

Implementation of Art. 77 GDPR, the right to lodge a complaint with a supervisory authority and

the principles of the procedure before the supervisory authority are regulated (1761 BlgNR 25. GP
15). From the materials it is clearly recognizable that with § 24 DSG the right of a

Affected parties to complain to a supervisory authority in accordance with Art. 77 GDPR

is specified. It cannot be inferred from the materials that with Section 24 DSG the scope of the
The rights of a person concerned to lodge a complaint are restricted.


In accordance with Section 24 (1) DSG, every data subject has the right to lodge a complaint with the
Data Protection Authority when it considers that the processing is relevant to you

personal data - (among other things), meant among other things - against § 1 DSG, which also

protects the right to secrecy. According to § 24 para. 2 Z 5 DSG, the complaint
to refrain from seeking to establish the alleged infringement. As far as one

If the complaint proves to be justified, it must be followed according to Section 24 (5) first sentence DSG

Accordingly, the law provides a legal remedy in the event of a violation of data protection law - 45 -


explicitly submit an application for a determination as part of the complaint, which pursuant to Section 24 (5) DSG
It must be followed if it proves to be entitled (VwGH19.10.2022, Ro2022/04/0001).


Therefore, a person considers that the processing concerns them
personal data leads to a violation of their rights, according to § 24 DSG

a right expressly provided for in law to have this determined. In this

context, it should be noted that not only a finding of infringement
according to § 1 DSG (right to secrecy) is possible. With the expression "among other things"

the Administrative Court clearly indicates that not only violations of rights
can be determined, which are based on § 1 DSG (right to secrecy). Also § 24

Para. 2 DSG is no restriction to the effect that a data subject

could only request a declaration of a violation of the right to secrecy.

At the subject of the proceedings, the BF1 showed a violation of rights pursuant to Section 24 (2) DSG

to the effect that the processing of his personal data violates the GDPR
violates (Article 77 GDPR). Specifically, the BF1 requested a determination as to whether a violation of

general principles of data transmission in accordance with Art. 44 GDPR.

Without a doubt, every person has the subjective right if their personal data is processed by

are processed by others, that the processing of the personal data of
concerned in accordance with the GDPR. According to the jurisprudence of

European Court of Justice must agree with any processing of personal data

in line with the principles set out in Art. 5 of the GDPR for the processing of data
and on the other hand related to one of the principles listed in Art. 6 of the GDPR

comply with the lawfulness of the processing (ECJ 22.06.2021, C-439/19 (Latvijas

Republikas Saeima), para. 96). To the extent that a data subject believes that the
Processing of personal data does not comply with the GDPR, it is to that effect

an individual complaint according to § 24 DSG admissible.

It is particularly important to emphasize that the subject of the proceedings is that the European Court of Justice

(ECJ July 16, 2020, C-311/18 (Schrems II), para. 158) it was assumed that the
Noting that “[…] the law and practice of a country does not provide an adequate level of protection

ensure [...]" and "[...] the compatibility of this (appropriateness) decision with

the protection of privacy and the freedoms and fundamental rights of individuals […]” in
Asserted as a subjective right as part of a complaint under Art. 77 (1) GDPR

can be. In this context, the DA correctly stated that the question referred
of the mentioned procedure does not cover the "extent of the right of appeal of Art. 77 Para. 1

DSGVO "was the subject; the ECJ has the fact that also a violation of

Provisions of chapter VDSGVO in the context of a complaint according to Art. 77 Para.1 DSGVO - 46 -


can be invoked is evidently considered a necessary condition. At
From a different point of view, the ECJ would have said that the question of the validity of a

adequacy decision was not clarified at all in the context of a complaints procedure

(VWA ./59, page 23 f).

Overall, the bB is authorized to determine a violation of law according to Art. 44 ff DSGVO.

II.3.5. About the distribution of roles:

At the time of the proceedings, the MB, as the website owner,
Decision made to implement the "XXXX -Analytics" tool on the XXXX website.

Specifically, it has a JavaScript code ("tag") provided by BF2,

inserted in the source code of your website, which means that this JavaScript code is used when you visit the
website was running in the browser of the BF1. The MB has said tool for the purpose

used for statistical evaluations of the behavior of website visitors. Since the

MB about the purposes and means of those related to the tool
has decided on data processing, she is the person responsible within the meaning of Art. 4 Z 7 DSGVO

to watch.

Subject matter of the proceedings is to be noted that the subject matter of the complaint relates only to the

Data transfer to BF2 (United States). In connection with the
Data transmission with the tool XXXX -Analytics should be noted that the BF2 the tool only

makes available and has no influence on whether it is at all or to what extent the MB

makes use of the tool functions and which specific settings it chooses.
Insofar as BF2 XXXX only provides analytics (as a service), it has no influence

on "purposes and means" of data processing and is therefore in accordance with SdArt. 4Z8DSGVO case-related

to qualify as a processor.

II.3.6. Regarding point A.I) - rejection of the complaint by the BF2:

II.3.6.1. On the right to lodge a complaint with BF2:
With the help of the findings in point 2. in the decision that is the subject of the proceedings

clarified whether a violation of the general principles of data transmission according to Art. 44

DSGVO by the MB is available. The judgment point 2. is according to § 59 paragraph 1 AVG of the rest
Spell points separable because he stands alone without an inner connection with

other parts of the procedure is accessible to a separate objection (cf. e.g. VwGH

September 12, 2018, Ra 2015/08/0032). The bB correctly stated that the possible violation of
Art. 5 ff in conjunction with Art. 38 Para. 3 lit. a and Art. 29 GDPR by the BF2 in no connection

with the requirements of Art. 44 GDPR (VWA ./67, page 14). - 47 -


The question of who has party status in a specific administrative procedure can be answered on the basis of
of the AVG alone cannot be solved. Rather, the party position must derive from the

substantive regulations are derived. On the ground of the material

Administrative law it must according to the subject of the relevant administrative procedure
and assessed according to the content of the applicable administrative regulations

become. The constituent element of party status in administrative matters

determined according to the normative content of the case to be applied
regulations. The terms "legal claim" and "legal interest" are only gaining ground

the applicable administrative regulation on a specific content,

according to which only the question of party status can be answered (VwGH April 19, 2022, Ra
2021/02/0251). Against this background, a party position in the administrative court

Proceedings cannot be justified with it, because the results of the proceedings are different

procedures may affect; the party status (or legal interests) is derived
Rather, it depends on the relevant administrative regulation that is the subject of the

administrative procedures.

As explained under point II.3.3, Art. 44 GDPR regulates the admissibility of a

Data transfer to a third country. Based on the case law of the European
Court of Justice, the data exporter (the MB) is responsible for checking the

Admissibility of the specific transmission. He must check at any time whether the data

are protected in the third country. Against this background, it is clear that the
Regulations in Chapter V GDPR without exception subject public rights/duties of the

data exporters (thus the MB) have as their subject. In contrast, subjective

public rights/duties for the data importer in a third country from Chapter V GDPR
not to be taken. This is also evident from the fact that for the assessment of the

Legal question as to whether a data exporter has violated obligations under Chapter V GDPR,
in principle, the data importer does not have to participate in the procedure. Is

therefore a data importer for example for a supervisory authority not at all

reachable, this circumstance does not prevent the supervisory authority from
Violation of the data exporter's rights to be determined in accordance with Chapter VDSGVO

therefore the BF2 in connection with the assessment of the legal question of whether the data exporter

(i.e. the MB) violated obligations under Chapter V GDPR in the procedure of the bB (VWA ./59,
Point 2) no party status.

In point 3 of the ruling at issue, the BF2 was a party to the

Procedure because the bB clarified the legal question as to whether the BF2 violated obligations under Art. 44 GDPR

has violated. However, since Art. 44 or Chapter V GDPR no public law - 48 -


provides for obligations for a data importer in a third country, the BA has a
BF1's request to that effect rejected. The BA confirmed to that effect

Right view of the BF2 (see point II.3.3 above).

As explained, the BF2 did not come in connection with ruling point 2 in the procedure of the DA

party position. However, this party position in administrative procedures is

essential prerequisite for filing a complaint against a decision
administrative court. Party status in administrative proceedings and authority to

Complaints are directly related according to the domestic legal situation
(VwGH 05.04.2022, Ra 2022/03/0073). Since the BF2 in the administrative procedure to verdict point

2. no party status was accorded to the decision at issue in the proceedings was hers

dismiss the complaint to that effect.

Furthermore, it is pointed out that a preliminary question-based assessment in decisions

generally no binding effect for other authorities (or even the same authority in a
other procedures), for whose decision the same question or one with content

comparable (although not to be qualified as a preliminary question in the legal sense) question from

(VwGH 01/20/2016, Ro 2014/04/0045). In addition, the main question
the partial decision that is the subject of the proceedings, the agreement regarding a violation of

Art. 44 GDPR, i.e. the question of whether the data transfer in question is in a
third country was legally permissible. The main question, however, does not include individual statements

some elements of the facts of Art. 44 ff GDPR, which are explained in point 2

are.

It should also be noted that BF2 acted as a processor for MB

Attributable to actions of the MB (Art. 28 GDPR), which finally lead to a
infringement of rights by the MB. In this context it is pointed out that

that the MB did not appeal against the decision of the DA.

II.3.6.2. On the lack of infringement of subjective rights of BF2:

Regardless of the lack of party status (see point II.3.6.1), contrary to the
Explanations of BF2 (VWA ./62, page 8), in the case of a violation of subjective

Basically no rights. This is due to the following considerations:

II.3.6.2.1. For the processing of personal data:

According to Art. 2 Para. 1 GDPR, personal data are the starting point for this factual
Applicability of the GDPR. In this regard, the European Court of Justice

repeatedly stated that the scope of the GDPR should be understood very broadly

(ECJ 06/22/2021, C-439/19 (Latvijas Republikas Saeima), para. 61; 12/20/2017, C-434/16 - 49 -


(Peter Nowak), marginal note 59). This basic understanding is the further explanations
to take as a basis. Against this background, the view of the BA is to be followed that an intervention

in the fundamental right to data protection according to Art. 8 EU-GRC and § 1 DSG already exists,

if certain measures are taken (e.g. assignment of identification numbers) to website
individualize visitors.


In the present case, BF2's own explanations and behavior indicate that
that the information that is the subject of the proceedings (see point II.1.3.1)

represent personal data. The BF2 itself explains that within the framework of the
Order processing service "XXXX Analytics" the data "Online identifiers

(including cookie identifiers), internet protocol addresses and device identifiers and

identifiers assigned by the customer" can be personal data. In addition
set the BF after the judgment of the European Court of Justice of July 16, 2020 in the

Case C-311/18 several measures to ensure a legally compliant transfer of

personal data to the United States (see point II.1.9) to allow.
These explanations and behavior are the less convincing explanations

the MB or the BF2 against that the change of

Order data processing conditions (DTPS) from August 12th, 2020 including the
Standard Contractual Clauses (SCCs) were only made for proactive reasons.

In principle, it should be noted that from the information transmitted on August 14th, 2020

(see point II.1.3 and II.1.3.1) no direct personal reference can be inferred.

Online identifiers (IP address, cookies, etc.) identify on their own
regularly no person, since from them directly neither the identity of the natural

person who owns the end device (computer) from which a website was accessed,

nor the identity of another person who could use this computer (ECJ
October 19, 2016, C-582/14 (Breyer), para. 38). However, identifiability depends on the circumstances

possible.

A piece of information makes a natural person identifiable if through it alone the

Although identification (i.e. recognition) itself is not directly possible, a
corresponding identification but by means of linking to further information

can be made. According to Art. 4 Z 1 DSGVO, a person is identified as identifiable

viewed directly or indirectly, in particular by means of assignment to an identifier such as
a name, identification number, location data, online identifier, or

one or more special characteristics that express the physical, physiological,

genetic, psychological, economic, cultural or social identity of these
natural person can be identified. Knowing the name of the natural - 50 -


However, a person is not absolutely necessary for identifiability (Art.-29-

Data Protection Working Party, WP 136, page 16 f).

To determine whether a natural person is identifiable, all means are to
take into account that of the person responsible or another person according to general

Discretion likely to be exercised directly or indirectly to the individual

identify (recital 26, 3rd sentence). The purely hypothetical possibility of identifying the
However, person is not sufficient for the person to be considered identifiable. It is however

It is also not necessary for the person responsible to actually initiate or cross efforts

already has the appropriate means to bring about identification, but it
the probability that he initiates them or acquire corresponding funds is sufficient

becomes. For the assessment of the question of identifiability, it is therefore not important whether

a controller has actually attempted identification
to do. It is sufficient that utilizing a means under purely abstract too

judging point of view is likely.

In determining whether funds are reasonably likely to identify

of the natural person are used in the context of a risk analysis or forecast

(according to recital 26, 4th sentence) all objective factors, such as the cost of identification and the
time required for this, which is at the time of processing

available technology and technological development must be taken into account.

According to the case law of the European Court of Justice, this is a factual one
Risk of creating a personal reference required (ECJ 19.10.2016, C-582/14

(Breyer), para. 38). To determine whether such a risk exists, it is - in addition to the in ErwG

26, 3rd sentence expressly mentioned factors – also to consider whether the purpose of
Processing requires identification, whether identification to a

Increase in usage and whether the identification is contractual and/or organizational
                                                                                    4
Obstacles (e.g. contractual penalties) (Taeger/Gabel, GDPR BDSG TTDSG, Art. 4,
31). In the present case, an increase in use can be assumed because

e.g. through the online identifiers used (IP address, cookies) a distinction from

website visitors is allowed. Also, in the context of big data applications, the
Threshold for assuming a personal reference is simply low (Kuhling/Buchner,

DSGVO BDSG, Art. 4 No. 1, Rn 22). For example, does a company have two different

Databases store information about people (however, viewed in isolation, none
enable clear assignment to a person), their merging into one

Identification would lead and considering the typical way on the market

available data analysis tools with a reasonable amount of time and money - 51 -


would be, the identifiability of the not (yet) merged databases would be too
                                           4
affirm (Taeger/Gabel, GDPR BDSG TTDSG , Art. 4, Rn31).
already a "digital footprint" that allows devices - and subsequently the

specific user - to be clearly individualized, represents a personal date

(cf. KarglinSimits/Hornung/Spiecker, data protection law, Art. 4Z1, Rn52mwN).
Fingerprinting (RFC6973) can be used by an observer using a device or application instance

sufficient probability on the basis of several information elements (online

identifiers, IP address, browser information, etc.).

In addition, the argumentation of the bB is to be followed that the implementation of XXXX-Analytics
on XXXX results in segregation within the meaning of ErwG 26. In other words: who a tool

used, which makes such a segregation possible in the first place, cannot refer to the

position not to use any means to obtain natural
to make people identifiable. It can be assumed that without using the

procedural information (see point II.1.3.1) the BF2 not able

would be to offer a usable measurement service (see point II.1.4), because for example the BF2 without
Cookies would not be able to provide traceable measurements of website visits

to perform.

Due to the circumstances at hand – big data, benefit increases, the purpose and the

Functionality of the web analytics service XXXX -Analytics and Fingerprinting - is from a

factual risk that the BF2 as the processor of the MB
reasonably likely means of identifying the individual

uses.

With the information transmitted to the BF2 (see point II.2.3 or II.2.3.1), a

"digital footprint" of the BF1 generated, which the BF2 as the processor of the MB
allows to identify the BF1.


With regard to online identifiers, it should be noted that the cookies in question
"_ga" or "cid" (client ID) and "_gid" (user ID) unique XXXX -Analytics identifiers

contained and stored on the end device or in the browser of the BF1. With these

Identifiers, it is sometimes possible for the BF2 to distinguish website visitors and also the
Receive information about a new or returning website

XXXX visitors. Without these identification numbers is therefore a distinction from

Website visitors not possible. In this context, the European
Data protection officers consider that all records containing identifiers

contain, with which users can be singled out, according to the regulation (meant - 52 -


Regulation (EU) 2018/1725) are considered personal data and treated as such
must be protected (VWA ./68).


With regard to the IP address, it should be noted that the "anonymization function" of the IP
Address was not correctly implemented at the time of data transmission to the BF2

and was therefore completely saved by the BF2. In this context is to

note that the general storage of IP addresses constitutes a serious intrusion into the in
fundamental rights enshrined in Articles 7 and 8 of the Charter, since it is possible with IP addresses

is accurate conclusions about the private life of the user of the relevant electronic
to draw means of communication. This can be a deterrent to the

exercise the freedom of expression guaranteed in Article 11 of the Charter (ECJ

20.09.2022 in joined cases C-793/19 and C-794/19 (SpaceNetAG/Telekom
Germany GmbH), para. 100). It also doesn't matter who my IP address actually belongs to:

The decisive factor is whether the IP address can be used to draw conclusions about the data subject

(User) can be drawn. Therefore, the statements of BF2 no
Justification value if it considers that the IP address used

possibly owned by BF1's employer. Regardless, the procedure

revealed that the IP address of BF1 was transmitted directly to BF2.

Already from the combination of the transmitted information (see point II.1.3.1) - online
identifiers, IP address, browser information, operating system, screen resolution,

language selection, etc. - a "digital footprint" can be generated that allows

To clearly individualize the end device and subsequently the specific user.
Irrespective of this, in the present case for BF2 as the processor

Traceability to the BF1 possible:

So the BF1 was XXXX on his XXXX account at the time he visited the website

logged in. The BF2 explained that due to the fact that the tool XXXX -
Analytics is implemented on a website that receives information. This includes the

Information that a specific XXXX account user visited a specific website

(VWA ./31, Question 9). In this context, BF2 explained that this only applies to
Activation of specific settings in the XXXX account is possible (activation of

"Personalized Advertising" and "Web and App Activity" through the XXXX -Account-

users and activation of XXXX signals on the target website). The BB led to this
understandable from the fact that the identifiability of a website visitor does not depend on it

may depend on whether certain declarations of intent are made in the XXXX account, since

from a technical point of view, all possibilities for identification would still be available.
On the other hand, the BF2 could - 53 -


User after personalization of the received advertising information do not match.
In this regard, it must be taken into account that Art. 4 Z 1 GDPR is linked to “can”.

("can be identified") and not whether an identification ultimately also

is made.

Regardless of this, it should be noted that certain settings in a XXXX account

or by activating XXXX signals on a website merely adapting to the
personal needs of users of XXXX applications. The adjustments

by the users do not give any conclusions about the processing of
Meta information by the BF2, which in the course of calling up an application ( XXXX -

Analytics, XXXX account, XXXX ,etc) are transmitted to BF2. In process is in this

Connection of meta information and IP address between XXXX -
Account and XXXX -Analytics emerged, which an undisputed personal reference

enabled.

Regardless of the BF2, there is a real risk that US authorities will

Discretion likely to use means to identify the BF1. In this

In this context, the BF1 understandably explained that US intelligence services online
Identifiers (IP address or unique identifiers) as a starting point for the

Engage surveillance of individuals. Thus, in particular, cannot be ruled out
be that these intelligence services have already collected information with which

Help the data transmitted here can be traced back to the person of BF1. This is how the

BF2 due to data requests metadata and content data. The fact that it is
This is not just a "theoretical danger", as can be seen from the judgment of the

European Court of Justice from July 16th, 2020, C-311/18 (Schrems II), due to the

Incompatibility of such methods and access possibilities of the US authorities with the
Fundamental right to data protection according to Art. 8 EU-GRC ultimately also the EU-US

adequacy decision (“Privacy Shield”) has been declared invalid. In this

context, neither the BF1 nor the MB have the opportunity to verify whether US
Authorities have already received personal data, or whether US authorities

already have personal data from BF1. This circumstance may be of affected

People like the BF1 are not to be blamed. So it was ultimately the MB and also
the BF2, which despite the publication of the above-mentioned judgment of the European Court of Justice

July 16, 2020 continued to use the XXXX -Analytics tool. After all, he is too
To follow the reasoning of the bB that the MB is subject to accountability (Art. 5 para.

2 in conjunction with Article 24 (1) in conjunction with Article 28 (1) GDPR) that processing is carried out in accordance with the regulation

took place. In this context, the MB has its processor (BF2) in the process - 54 -


no organizational or technical measures identified which are suitable,
Methods and ways of accessing the US authorities to prevent it from happening

Violation of the fundamental right to data protection according to Art. 8 EU-GRC.

As a result, the transmitted information (see point II.1.3 or II.1.3.1) represents in any case

in combination represents personal data in accordance with Art. 4 Z 1 DSGVO.

II.3.6.2.2. On the lack of an appropriate level of protection in accordance with Art. 44 GDPR:

Art. 44 GDPR sees a basic provision for international data transfer
two-stage admissibility check. The first requirement that data is ever in a

third country may be transmitted, is that the other provisions

of the GDPR (such as Art. 5 f, Art. 13 f GDPR) are complied with. As part of the second
At the first stage, it must be checked whether one of the requirements of Art. 45 – 49 GDPR is met. The first in

According to Art. 45 GDPR, the admissibility in question is present if the

Commission has determined in an adequacy decision for the third country concerned that
that it offers an adequate level of protection. Is there such a thing?

adequacy decision, no approval is required for data transfer in

the respective third country. If there is no adequacy decision, it must be checked further whether the
Requirements according to Art. 46, 47 or 49 GDPR are met.

After the European Court of Justice declared the "EU-US Privacy Shield" with the decision of

16.07.2020, C-311/18 (SchremsII) declared invalid, the procedural

Data transmission on August 14, 2020 (see point II.1.3 or II.1.3.1) on the basis of a
adequacy decision can no longer be justified. With the decision of

European Court of Justice clarified that the United States until further notice

are to be regarded as a "third country" and are currently privileged for the transmission of
personal data according to Art. 45 GDPR does not exist.

Since there is no adequacy decision according to Art. 45 Para. 3 GDPR, Art. 46

GDPR further admissibility ("suitable guarantees"). If one of the in Art. 46

Para. 2 GDPR listed guarantees, is international data traffic
allowed without permission. The guarantees of Art. 3 GDPR exist subject to one

Approval by the competent supervisory authority. If none of the provisions in Art. 46 Para. 2 and

Para. 3 GDPR, it must be checked further whether one of the
Exceptions for a permissible third-country transfer according to Art. 49 GDPR are fulfilled.

At issue in the proceedings, the MB based the transfer on standard data protection clauses

in accordance with Article 46 (2) (c) GDPR. For further "suitable guarantees" according to Art. 46 DSGVO

the transfer of the data at issue in the proceedings was not supported by the MB. - 55 -


Therefore, the admissibility of the data transmission according to Art. 46 Para. 2 lit. c
GDPR examined.


II.3.6.2.2.1. For data transfer based on standard data protection clauses in accordance with
            Article 46 (2) (c) GDPR:

On August 12, 2020, the MB and the BF2 have in accordance with Article 46 (2) (c) GDPR

Standard data protection clauses for the transfer of personal data to the
United States completed. (“ XXXX Ads Data Processing Terms: Model Contract

Clauses, Standard Contractual Clauses for Processors”). Specifically, it was about
at the point in time at which the complaint is made by those clauses in the version of

Implementing decision of the European Commission 2010/87/EU of February 5, 2010

about standard contractual clauses for the transfer of personal data
Processors in third countries according to the Directive 95/46/EG of the European Parliament

and of the Council, OJ L 2010/39, p.

When transferring personal data to a third country, the

Standard Data Protection Clauses Enforceable Rights and Effective Remedies

ensure that they enjoy a level of protection equivalent to that in the Union through the GDPR in
The level guaranteed by the Charter is equivalent in substance. In this

In connection with this, the contractual regulations must be taken into account in particular
between the controller based in the Union and that in the third country concerned

resident recipients of the transfer have been agreed, as well as what any

Access of the authorities of this third country to the transmitted personal data
concerns, the relevant elements of the legal system of that country, in particular the

Article 45 (2) of the GDPR (ECJ July 16, 2020, C-311/18 (Schrems II), Rn

105). The competent supervisory authority is obliged to draw up a standard data protection clause
to suspend or permit the assisted transfer of personal data to a third country

prohibit if that authority considers in light of all the circumstances of this transfer

is that the clauses in this third country are not respected or not respected
and that according to Union law, in particular according to Articles 45 and 46

of the GDPR and according to the charter, the required protection of the transmitted data

can be guaranteed by other means (ECJ July 16, 2020, C-311/18 (Schrems II), para
121).

In the present case, it should first be noted that the European Court of Justice used the “EU-US

Privacy Shield” has therefore been declared invalid, as this with Articles 7, 8 and 47 of the Charter

was incompatible (ECJ July 16, 2020, C-311/18 (Schrems II), para. 150 ff), since it was for US authorities
(intelligence services) offered disproportionate access opportunities and no effective - 56 -


Legal remedies for victims (non-US citizens) were available. That's how he led
European Court of Justice guaranteed that regarding Art. 7 and 8 of the Charter

Fundamental Rights neither Section 702 of FISA nor the E.O. 12333 in conjunction with the PPD-28

those existing in Union law based on the principle of proportionality
Meet the minimum requirements, so it cannot be assumed that the on these

regulation-based surveillance programs to the extent absolutely necessary

are limited. Also, with regard to those based on Section 702 of FISA as well
with regard to the E.O. 12333 supported monitoring programs to note that

neither the PPD-28 nor the E.O. 12333 confer rights on data subjects that

can be legally enforced against the American authorities, so that
these persons do not have an effective remedy. In this connection

the ombudsman mechanism mentioned in the adequacy decision does not offer legal recourse

to an entity that provides individuals whose data is transferred to the United States
would offer guarantees equivalent to the guarantees of the thing required under Article 47 of the Charter

after would be equivalent.

These circumstances, which led to the lifting of the "EU-US Privacy Shield", are also at the

assessment of a data transfer in accordance with Article 46 (2) (c) GDPR.
In this regard, it should be noted that the standard data protection clauses are by their nature not

Can offer guarantees that go beyond the contractual obligation, for compliance with the

to ensure the level of protection required under Union law. In particular, they can
due to the nature of the contract, no third-country authorities (such as US

intelligence services) (ECJ July 16, 2020, C-311/18 (Schrems II), para. 132 f).

These considerations can be applied to the present case. So is

obvious that the BF2 as a provider of electronic communication services within the meaning of
50 U.S. Code § 1881(b)(4) and thus subject to surveillance by U.S.

Intelligence agencies are subject to 50 U.S. Code Section 1881a (“FISA 702”). Accordingly, the BF2

the obligation to report to U.S. authorities under 50 U.S. Code § 1881a personal data
to provide. The agreed between the MB and the BF2

Standard data clauses do not offer any options in this context

To meet requirements effectively or to prevent them. How from the
transparency report of BF2, such inquiries are also regularly received from US

authorities placed on them.

The data transmission in question can therefore not solely be based on the between the MB and

of the BF2 concluded standard data protection clauses in accordance with Article 46 (2) (c) GDPR
be supported. - 57 -


Because, by their very nature, these standard data protection clauses cannot provide any guarantees that
about the contractual obligation to comply with what is required under Union law

Levels of protection going beyond that may vary depending on the situation in a particular third country

given situation, it may be necessary for the person responsible to take additional measures (see
point II.3.6.2.2.2) to ensure compliance with this level of protection.


II.3.6.2.2.2. Regarding the additional measures:
In its "Recommendations 01/2020 on measures to supplement transmission tools for

Ensuring the Union legal level of protection for personal data, version
2.0 of the European Data Protection Board (“EDPB Recommendations”)” the EDPB

stated that in the event that the law of the third country affects the effectiveness of

appropriate safeguards (such as standard data protection clauses), the data exporter
either suspend the data transfer or take additional measures

implement (EDSA recommendations Rn 28 ff and Rn 52 or ECJ July 16, 2020, C-

311/18 (Schrems II), para. 121).

According to the recommendations of the EDPB, such “additional measures” can be contractual,

be of a technical or organizational nature (EDSA recommendations, para. 52):

With regard to contractual measures, it is stated that these "[...] the guarantees that
provide the transmission tool and the relevant legislation in the third country,

supplement and strengthen, as far as the guarantees, taking into account all circumstances

of transmission, do not meet all the requirements necessary to register
to ensure a level of protection essentially equivalent to that in the EU. Since the

contractual measures, by their very nature, the authorities of the third country generally do not

can bind, if they are not themselves a party to the contract, they must with others
technical and organizational measures are combined to achieve the required

to ensure a level of data protection. Just because you have one or more of these actions
selected and applied does not necessarily mean that it is systematic

it is ensured that the intended transfer meets the requirements of Union law

(ensuring an essentially equivalent level of protection) is sufficient” (EDSA-
Recommendations 01/2020, para. 99).


With regard to organizational measures, it is stated that they are "[...] internal strategies,
Organizational methods and standards act that those responsible and

apply to processors themselves and to data importers in third countries
could impose. These can be uniform throughout the processing cycle

Protection of personal data. Organizational measures can also contribute to this

help ensure that data exporters are aware of the risks related to data access in - 58 -


Third countries and related access attempts are better aware and more alert
can react. Just because you selected one or more of these measures and

applied, this does not necessarily mean that it is systematically ensured that

the intended transfer meets the requirements of Union law (ensuring a
of items with equivalent levels of protection) is sufficient. Depending on the special circumstances of

transmission and the assessment of the legal situation in the third country

organizational measures to supplement the contractual and/or technical ones
Measures required to ensure the protection of personal data

is equivalent to the level of protection guaranteed in the EEA" (EDSA-

Recommendations 01/2020, para. 128).

Regarding the technical measures, it is stated that these "[...] guarantees that the
offer transmission instruments in Art.l 46 DSGVO, can supplement to ensure

that the protection required under Union law also applies to the transmission of personal data

data to a third country is guaranteed. These measures are particularly
required if the law of the third country in question tells the data importer

Obligations imposed that correspond to the guarantees of the transmission instruments mentioned in Art.

46 GDPR and are therefore suitable for the contractual guarantee of one thing
according to equivalent levels of protection as far as official data access in the third country is concerned,

to undermine" (EDSA Recommendations 01/2020, para. 77).

An additional measure is only considered effective within the meaning of the judgment of the European

Court of Justice (ECJ 16.07.2020, C-311/18 (Schrems II)), if and to the extent that they -
alone or in connection with others - closes precisely the legal protection gaps,

that of the data exporter in its review of the applicable to its transfer

established legislation and practice in the third country. Should it be the data exporter
ultimately not be possible to achieve an equivalent level of protection,

he may not transmit the personal data (EDSA Recommendations 01/2020, Rn

75).

Applied to the present case, this means that it must be examined whether the
"Additional measures taken" by BF2 (see point II.1.10 or VWA ./31, page 23 ff)

within the framework of the judgment of the European Court of Justice (ECJ July 16, 2020, C-311/18

(Schrems II)) identified gaps in legal protection - i.e. inappropriate access and
Surveillance capabilities of US intelligence services and insufficient effective

Legal remedy for those affected – close.

Against this background, it must therefore be checked whether the additional measures taken by BF2

Measures are suitable, the illegal circumstances - disproportionate - 59 -


Possibilities of access by US authorities or the lack of effective legal remedies for
Affected – to eliminate, so that the fundamental rights guaranteed in Articles 7, 8 and 47 of the Charter

not get hurt.

With regard to the contractual and organizational measures set out, is not

recognizable to what extent through a review of a request from US authorities by XXXX -

Attorneys or by specially trained personnel to comply with applicable laws and
XXXX guidelines that do not violate the fundamental rights guaranteed in Articles 7, 8 and 47 of the Charter

become. Compliance with US laws – i.e. the obligation to release data
– leads precisely to the violation of the fundamental rights of the Union citizens concerned. As well

there is no justification value for notifying customers before any of their

Information US authorities will be announced. This is because a transfer of
Information is disproportionate under European law and the data subject

Union citizens have no effective legal remedies against disclosure. Also it comes to

a violation of fundamental rights of EU citizens concerned, if a notification to
customers are omitted for US legal reasons. Even if the request of a US

authority is omitted due to an emergency, the disclosure is unlawful, since the

Union citizens concerned do not have the opportunity to use an effective legal remedy
to verify the emergency. Finally, the release of a

transparency report and the publication of BF2's policy on dealing with

Government requests do not remove the unlawful circumstances for the purposes set out in Art. 7, 8 and
47 of the charter are not violated.

The technical measures presented are also not suitable for preventing the violation of the

eliminate fundamental rights. The technical measures listed in the

Access options in connection with the transmission or storage of the data
by US intelligence services based on US law neither prevent nor

restrict. As correctly led by the bBaus, the technical measures cannot be considered

be considered effective if the BF2 itself still has the ability to access the
access data in plain text. As far as the BF2 refers to an encryption technology,

it can be inferred from EDSA recommendations that a data importer (the BF2), the 50 U.S.

Code is subject to Section 1881a (“FISA 702”) with respect to the imported data contained in its
possession or custody or under his control, has a direct obligation to

grant access to or release them. This obligation can
also expressly extend to the cryptographic keys, without which the data cannot be processed

are legible (margin no. 81). - 60 -


Also, the explanations of the BF2 are that as far as XXXX -Analytics data for measurement by
Website owners are personal data, should be considered as pseudonymous,

not suitable as an "additional measure". In this context, the

convincing view of the German Data Protection Conference, according to which "[...] the
The fact that the users are made identifiable via IDs or identifiers, none

pseudonymization measure within the meaning of the GDPR. In addition, it is not about

appropriate guarantees to comply with data protection principles or to safeguard the
Rights of data subjects if IP addresses, cookie

IDs, advertising IDs, unique user IDs or other identifiers are used. Then,

other than in cases where data is pseudonymized to the identifying data
obscure or delete it so that the persons concerned are no longer addressed

can, IDs or identifiers are used to distinguish the individual individuals

and make it addressable. Consequently, there is no protective effect. It is about
therefore not about pseudonymizations within the meaning of Recital 28, which the risks for those affected

Lower people and those responsible and the processors in compliance

support their data protection obligations" (cf. the guidance of the supervisory authorities
for providers of telemedia from March 2019, p. 15).

In addition, the arguments of BF2 cannot be followed because the XXXX -

Analytics ID combined with other elements anyway and even with a dem

BF2 indisputably attributable XXXX account can be connected.

The "anonymization function of the IP address" mentioned is not relevant to the case
Relevance because it was not implemented correctly (see point II.1.3.4).


Overall, the additional measures identified by BF2 are not suitable
Gaps in legal protection identified in the judgment – inappropriate access and

Surveillance capabilities of US intelligence services and insufficient effective
Legal remedy for those affected – close.


II.3.6.2.2.3. Summary:
Based on the decision of the European Court of Justice of July 16, 2020, C-311/18

(Schrems II), the data transfer at issue was not with the "EU-US

Privacy Shield". Also, the data transfer that is the subject of the proceedings cannot
based solely on the standard data protection clauses concluded between MB and BF2

in accordance with Article 46 (2) (c) GDPR. In addition, those of the BF2
The additional measures identified are not suitable for those identified in the judgement

Legal protection loopholes – inadequate access and monitoring options by US

intelligence services and insufficient effective legal remedies for those affected - to - 61 -


close. Overall, the data transmission that is the subject of the proceedings is not covered
in Art. 46 GDPR.


As far as the BF2 in administrative procedures a risk-based approach
Assuming, it should be noted that this approach already differs from the wording of Art. 44 GDPR

Article 44 GDPR covers any transmission of personal

Data. The standard therefore does not differentiate between extremely low-threshold data
are transferred for which there is only a very low basis risk. Although the GDPR sees in

Individual provisions stipulate a risk-based approach (e.g. Art. 24 Para. 1 and Para. 2, Art.
Article 25(1), Article 30(5), Article 32(1) and (2), Article 34(1), Article 35(1) and Article 35(3).

or Art. 37 Para. 1 lit. b and lit. c GDPR), however, this circumstance does not mean that the

risk-based approach is to be applied analogously to Art. 44 GDPR.

The European Court of Justice (ECJ July 16, 2020, C-311/18 (Schrems II)) is in relation to the

Legal position of the US now just assumes that due to the disproportionate
Access possibilities of US authorities as well as insufficient effective legal remedies for

Those affected cannot be assumed to have an “appropriate level of data protection”, which is why

he finally also declared the EU-US adequacy decision to be invalid. The
The European Court of Justice has expressly not aimed at the fact that the obligations

which is a Privacy Shield certified company from the United States
subject, may be appropriate in individual cases (e.g. because the certified

Company only non-sensitive or non-criminal relevant personal data

data received).

With the help of the GDPR, the free movement of data should also be guaranteed. However, it stands

free traffic in this context on the premise that the specifications of
GDPR - and this also includes Chapter V - are fully complied with. A softening in the

In the sense of a "business-friendly interpretation" of the specifications of Chapter V in favor
however, free data traffic is not planned. Economic interests played

also irrelevant in the judgment of the ECJ of July 16, 2020, C-311/18 (Schrems II).

II.3.6.3. Regarding the exceptions for certain cases according to Art. 49 GDPR:

According to the MB's own information, the exception was in accordance with Art. 49 GDPR

not relevant for the data transfer in question (VWA ./11, page 13). also is
In the process it did not come out that his consent according to Art. 49 Para. 1 lit. a DSGVO

was caught. Since altogether no circumstances arose that a fact
according to Art. 49 GDPR would be fulfilled, the data transfer that is the subject of the procedure

are not based on Art. 49 GDPR. - 62 -


II.3.6.4. Result:
Since for the data transmission in question the MBan the BF2 (in the United States)

no adequate level of protection guaranteed by an instrument of Chapter V of the GDPR

there is a violation of Art. 44. The MB was (at least) for
Complaint-relevant time - i.e. August 14th, 2020 - for the operation of the XXXX website

responsible. The data protection violation of Art. 44 GDPR relevant here is

therefore attributable to the MB.

Overall, the BF2 was not in a position to rule that point 2. of the
To justify the CB's decision which would have violated its legal interests. Also

for this reason, the complaint by the BF2 was to be rejected.

II.3.7. Regarding point A.II) – inadmissibility of the revision:

According to § 25a Abs. 1 VwGG, the administrative court in the ruling of its knowledge or

Pronounce a resolution as to whether the revision is permissible in accordance with Art. 133 Para. 4 B-VG. The
Statement must be briefly justified.

The revision is allowed because the question of whether a data recipient (data importer in

a third country) in the procedure for establishing a violation of the general

Principles of data transmission according to Art. 44 GDPR are not yet sufficient
Judiciary of the Administrative Court exists.

It was therefore to be decided accordingly.


II.3.8. Regarding point B.I) - rejection of the complaint by the BF1:
As explained under point II.3.3, there are no subjective public ones from Chapter V GDPR

Rights/obligations to refer to BF2 as data importer. Against this background, the

BF1's complaint about a decision to be dismissed.

II.3.9. Re point B.II) - admissibility of the revision:
According to § 25a Abs. 1 VwGG, the administrative court in the ruling of its knowledge or

Pronounce a resolution as to whether the revision is permissible in accordance with Art. 133 Para. 4 B-VG. The

Statement must be briefly justified.

The revision is allowed because the legal questions shown here are not yet sufficient
Judiciary of the Administrative Court exists.


It was therefore to be decided accordingly.
</pre>