EDPS - 2020-1013
| EDPS - 2020-1013 | |
|---|---|
 | |
| Authority: | EDPS |
| Jurisdiction: | European Union |
| Relevant Law: | Article 6 GDPR Article 13 GDPR Article 5(3) ePrivacy Directive Regulation 2018/1725 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 05.01.2022 |
| Published: | |
| Fine: | None |
| Parties: | n/a |
| National Case Number/Name: | 2020-1013 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | English |
| Original Source: | EDPS (in EN) |
| Initial Contributor: | n/a |
The European Data Protection Supervisor (EDPS) issues a reprimand against the European Parliament for illegal transfer of data to the US, unclear cookies banners and cookies placed without valid consent, data protection notice not compliant with the transparency requirements, and failure to answer the access request of the complainants.
English Summary
Facts
In January 2021, noyb filed a complaint against the European Parliament on behalf of six Members of the European Parliament over an internal corona testing website. The issues raised were: confusing and unclear cookie banners, vague and unclear data protection notices, and the illegal transfer of data to the US.
Holding
1. On data controllership
According to the EDPS, the processor may enjoy a considerable degree of autonomy in providing its services and may identify the ‘non-essential’ elements of the processing operation. Furthermore, the processor may advise or propose certain measures in this respect, but it is up to the controller to decide whether to accept such advice or proposal, after having.
The analysis of the EDPS shows that the EP delegated some aspects on the setting up and functioning of the website to EcologThe EDPS considers the Parliament as the sole data controller for the processing in question, i.e. the operation of the Parliament’s dedicated website, whereas Ecolog acts as a processor.
After having assessed the instructions given by the EP to the processor, the EDPS concluded that the EP did not show the necessary diligence required from a data controller and, ultimately, failed to comply with the Regulation, in particular with Articles 26(1) and 29(1) of the Regulation.
Moreover, the EDPS considers that the EP failed to provide the necessary detailed instructions to Ecolog for the setting up of the website, including the drafting of the data protection notice. The absence of domcumented instructions is therefore an violation of Article 29(3) of the Regulation.
2. Transparency and information requirements
The EDPS confirmed that the data protection notice published at the time of the complaint did not reflect the processing done by the EP, since they copied the data protection notice of the testing center of Zaventem's airport. Moreover, the reference to Article 6(1)(f) GDPR is wrong since stems from the same error. THe EDPS confirmed that the EP did not meet its transparency requirements.
The EDPS also analysed the updated version of the data protection notice during the procedure and raised several remaining -and even new- inconsistencies and issues. Among other things, the following problems persisted after the data protection notice was updated: - a mere reference to Article 15 and 16 of the Regulation is misleading as the Regulation applies in its entirety - the reference to the processing of health data is not correct since no such data are processed in the case at hand - the retention period mentioned is not precise enough - the sections of the data protection notices relating to the recipients of the personal data fail to make any reference to the processor - inconsistencies between the different linguistic versions of the data protection notices were still observed: The English and German versions refer to Ecolog and the Laboratory van Poucke as processors under Article 29 of the Regulation, whereas the French version refers to them as controllers (‘responsables du traitement’). Moreover, the DPO’s contact details on the website refer to Ecolog, in all three linguistic versions of the website, when they should be referring to the Parliament
3. Cookies and transfers of personal data to the US
The EDPS confirmed that tracking cookies, such as the Stripe and the Google analytics cookies, are considered personal data, even if the traditional identity parameters of the tracked users are unknown or have been deleted by the tracker after collection.
In the same vein, the EDPS rejected the EP's argument and confirmed that Upon installation on the device, a cookie cannot be considered ‘inactive’. Every time a user visited Ecolog’s website, personal data was transferred to Stripe through the Stripe cookie, which contained an identifier.
The EDPS reached the conclusion that a transfer of data was taking place to the US, via th euse of Google and Stripe cookies, since Google Analytics is hosted in the US and the data portection notice referred to SCC for the transfer of data outside of the EU.
However, the Parliament provided no documentation, evidence or other information regarding the contractual, technical or organisational measures in place to ensure an essentially equivalent level of protection to the personal data transferred to the US in the context of the use of cookies on the website.
4. Cookie banner on the Parliament’s dedicated website
The EDPS reminds that - before setting cookies or any other technology falling within the scope of Article 5(3) of the ePrivacy Directive, the EU institution must provide the user with adequate information on what is accessed or stored on the user’s terminal equipment, on the purposes of this action and the means for expressing their consent. - no action may be performed before the consent is collected. In addition, users must be enabled to withdraw their consent at any time - ‘cookie walls’ are not in line with the Regulation, meaning that for consent to be freely given, access to the website’s service and functionalities should not depend on the users’ consent for cookies that are not strictly necessary in the sense described above - in case personal data collected through the cookies are shared with third parties, such as analytics partners, the cookie banner should draw the users’ attention to it.
The EDPS has reached the conclusion that the cookie banners in all three languages were not in line with the definition of consent under Article 3(15) of the Regulation nor did they meet the requirements of Article 37 of the Regulation and Article 5(3) of the ePrivacy Directive. The cookie banner further failed to provide transparent information regarding the processing of personal data in relation to the cookies on the website.
5. Request for access to personal data
The Parliament was aware that the complainants’ personal data had been processed through the cookies, which were present on the website for the period between 30 September to 4 November 2020, since transfers of personal data had taken place. Consequently, and especially following the EDPS’ inquiry on the matter, the Parliament should have replied to the complainants’ access to personal data request.
The Parliament should have provided the relevant information even if it was aware that the processing of the personal data in question was unlawful, as the main purpose of the right of access under Article 17 is precisely to enable data subjects to become aware of the processing and verify the lawfulness thereof, or exercise other data subject rights.
Conclusion
The EDPS concludes that the Parliament has infringed the following Articles of the Regulation 2018/1725: a. Articles 26(1) and 29(1) due to its failure to fulfil its responsibilities as controller and use a processor providing sufficient guarantees to implement appropriate technical and organisational measures; b. Article 29(3) due to its failure to provide documentation relating to the detailed instructions given to the processor for the setting up and functioning of the website; c. Articles 4(1)(a) and 14, 4(2), and 15 due to its failure to respect the principle of transparency, accountability and the data subjects’ right to information because of the inaccurate data protection notice and cookie banner on the dedicated website; d. Article 46 and Article 48(2)(b) of the Regulation, due to its reliance on the Standard Contractual Clauses in the absence of a demonstration that data subjects’ personal data transferred to the US were provided an essential equivalent level of protection; e. Article 37 read in the light of Article 5(3) of the ePrivacy Directive, due to its failure to protect information (the cookies) transmitted to, stored in, related to, processed by and collected from the users’ terminal equipment; f. Articles 17 and 14(4) due to its failure to reply to the data subjects’ request for access to their personal data.
On the basis of the above, the EDPS decides: 1. to issue a reprimand to the Parliament in accordance with Article 58(2)(b) of the Regulation, for the above infringements; 2. to order the Parliament, pursuant to Article 58(2)(b) of the Regulation, to update its data protection notices in the dedicated website in order to provide all relevant information relating to the processing of personal data. The Parliament should address this order within one (1) month from the date of the decision.
Comment
This decision of the EDPS is interesting at many levels, since it confirms that cookies linked to US providers -even if inactive- are transferring data outside of the EU and should therefore meet the requirement of data protection law on transfers.
It also confirms that the cookies banners should mirror the actual use of cookies on the website and lis the recipiends receiving the data.
It also shows that the controllers remain in responsible for all processing operations on their website and should make sure that theu enter into an agreement or give written instructions to the processors regarding the processing operation and should demonstrate compliance with this obligation.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
