Digitaliseringsstyrelsen - Decision against Google of 30 October 2023
| Digitaliseringsstyrelsen - Decision against Google of 30 October 2023 | |
|---|---|
 | |
| Court: | Digitaliseringsstyrelsen (Denmark) |
| Jurisdiction: | Denmark |
| Relevant Law: | Article 4(11) GDPR Article 2(8) Cookiebekendtgørelsens Article 3 Cookiebekendtgørelsens |
| Decided: | 30.10.2023 |
| Published: | |
| Parties: | Google LLC |
| National Case Number/Name: | Decision against Google of 30 October 2023 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Danish |
| Original Source: | Digitaliseringsstyrelsen (in Danish) |
| Initial Contributor: | ar |
The Danish Agency for Digitalization, according to the Danish Cookie Law, ordered Google to adapt its cookie banner and the information provided in its cookie policy, as well as to make the information always accessible.
English Summary
Facts
On 1 and 16 September 2022, the Danish Business Authority sent consultation letters to Google LLC regarding the use of cookies on their website, based on how the banner looked at that time.
The Danish Business Authority pointed out that the website did not allow users to give granular consent. The text on the first layer of the cookie banner stated that by selecting "accept all", users agreed that Google could use cookies to process their data for four purposes. Users would also be given the option of dividing their consent under "More choices" on the second layer of the cookie banner. However, users were only given the option to split their consent over two purposes, different to the ones in the first layer. Secondly, the Danish Business Authority found that Google did not provide users with adequate information about all cookies used on the website. It also pointed out that the information was not considered to be permanently available through direct and marked access on the website, as it was difficult for users to retrieve information when clicking away the cookie banner.
On 13 September and 6 October 2022, Google Denmark ApS, Google LLC and Google Ireland Limited submitted comments to the letters. They argued that the material scope of the Danish Cookie Law is limited to the website operator, which in their cases is Google Ireland Limited. In light of this, they contested the Danish Business Authority’s territorial competence to supervise Google Ireland Limited.
Until 15 December 2022, the Danish Business Authority was responsible for supervising compliance with the Danish Cookie Law. Due to the reorganization, this task was transferred to the Danish Agency for Digitization (the Agency), which issued the decision.
Holding
Firstly, the Agency affirmed that the website owner is subject to the obligations regarding the use of cookies under the Danish Cookie Law. Meaning that Google LLC, as the website owner, was subject to its requirements. Henceforth, on the territorial scope, the Agency, citing the EDPB Internal Document 04/2021, reiterated that a supervisory authority is competent to handle a case when the controller or processor is established in that Member State and when the processing of personal data is carried out as part of the establishment's activities. Hence, the Agency confirmed to have territorial jurisdiction given that Google Denmark ApS, a subsidiary of Google LLC, has its registered office in Copenhagen, and because the placing of cookies on users’ terminal equipment was part of the activities carried out by Google Denmark ApS in the Danish market on behalf of Google LLC.
Secondly, on the Cookie banner, the Agency assessed that the four purposes described in the first layer of the cookie banner were not sufficiently similar to be grouped under the two overall purposes of the second layer. Since users should give separate consent for each general purpose under Articles 2(8) and 3(1) of the Cookie Law , the condition for voluntary and specific consent (as also described in Article 4(11) GDPR) was not met. In connection with this, the Agency acknowledged that the website allowed users to withdraw their consent. However, it was not immediately accessible and it was unclear how consent could be withdrawn, breaching Articles 3(2), (4) and (5) of the Cookie Law. Hence, the Agency ordered Google LLC to change the consent solution and provide users with immediate access to withdraw their consent to cookies.
Thirdly, the Agency assessed that users did not have access to a cookie policy with clear, precise and easily understandable language under Article 3(1) and (2) of the Cookie Law. This was because the information was given as examples, and the adequate explanation was only given in English, while the recipient group primarily spoke Danish. Additionally, the Agency found that the required information was not permanently available through direct access on the website, as it was difficult for users to retrieve information after clicking away the cookie banner - contrary to Articles 3(1), (2) and (5) of the Cookie Law. The Agency recognized this had been changed and now required fewer clicks for users to access the information. However, it still believed it was not easy for users to reach it. Therefore, the Agency required Google LLC to provide all the information in clear, precise and easily understandable language and for the information to be made always accessible.
In conclusion, the Agency ordered Google LLC to comply with the above requirements no later than 27 November 2023, and by the same date, explain how it complied with the orders.
Comment
The rules on the use of cookies can be found in the Danish Telecommunications Act, and the more detailed requirements for consent solutions regarding the use of cookies are laid down in the Danish Cookie Law. These two provisions originate from the implementation of the ePrivacy Directive and specify and supplement the GDPR.
It should also be noted that the Danish Agency for Digitization only supervises the rules in the Cookie Law. That explains why the Agency has not taken a position on the processing of the personal data collected via cookies and similar technologies on the website under the GDPR.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Danish original. Please refer to the Danish original for more details.
File history Click on a date/time to view the file as it appeared at that time. Date/TimeDimensionsUserComment current17:02, 21 November 2023 (514 KB)Ar (talk | contribs) You cannot overwrite this file.File usage There are no pages that use this file.
