In a groundbreaking decision in one of noybs 101 complaints, the Austrian Data Protection Authority (DSB) has decided that the use of Facebook’s tracking pixel directly violates the GDPR and the so-called “Schrems II” decision on transatlantic data flows. In 2020, the Court of Justice (CJEU) decided that the use of US providers violates the GDPR, as US surveillance laws require US companies, like Facebook, to provide user’s personal information to US authorities.
2020 CJEU ruling hits the real world. In July 2020, the CJEU ruled that a transfer to US providers that fall under FISA 702 and EO 12.333 violate the rules on international data transfers in the GDPR. The CJEU consequently annulled the transfer deal “Privacy Shield”, after annulling the previous deal “Safe Harbor” in 2015. While this sent shock waves through the tech industry, US providers and EU data exporters have largely ignored the case. Just like Microsoft, Google or Amazon, Facebook has relied on so-called “Standard Contract Clauses” and “supplementary measures” to continue data transfers and calm its European business partners. Therefore, noyb filed 101 complaints in August 2020 against websites still using Google Analytics and Facebook Tracking tools despite clear court rulings.
“Facebook has pretended that its commercial customers can continue to use its technology, despite two Court of Justice judgments saying the opposite. Now the first regulator told a customer that the use of Facebook tracking technology is illegal.” – Max Schrems, Chair of noyb.eu
Illegal Data transfers via Facebook Login and Meta Pixel. The DSBs decision to declare Google Analytics illegal, also applies to the “Facebook Login” and “Meta Pixel” tools provided by Meta: If these tools are used, data is inevitably transferred to the USA, where the data is at risk of intelligence surveillance. European website operators are therefore advised not to include any tools from Meta on their websites.
Decision relevant for almost all EU websites. Many websites use Facebook tracking technology to track users and show personalized advertisement. When websites include this technology they also forward all user data to the US multinational and onwards to the NSA. While the European Commission is still aiming to publish the third EU-US data transfer deal, the fact that US law still allows bulk surveillance means that this matter will not be solved any time soon.
Long Term Solution. In the long run, there seem to be two options: Either the US adapts baseline protections for foreigners to support their tech industry, or US providers will have to host foreign data outside of the United States. It is well known that due to its U.S.–based system, Meta is categorically unable to ensure that the data of European citizens is not intercepted by U.S. Intelligence agencies.
No penalty. There is no information if a penalty was issued or if the DSB is planning to also issue a penalty. The GDPR foresees penalties of up to € 20 million or 4% of the global turnover in such cases, but data protection authorities seem unwilling to issue fines, despite controllers ignoring two CJEU rulings for more than two years.
noyb funding goal
Apple hits back at European activist complaints against tracking tool
An Austrian privacy advocacy group drew a strongly critical response from Apple on Monday after it said an online tracking tool used in its devices breached European law.
101 Unternehmen leiten noch immer Daten an die USA weiter
Der Datenschutz-Verein noyb brachte 101 Beschwerden gegen den Datentransfer in die USA ein.
ZDF Magazin Royale vom 10. Dezember 2021
Expertentalk mit Datenschützer und Facebookbezwinger Max Schrems
Irish regulator proposes 36 mln euro Facebook privacy fine – document
The complaint, lodged by Austrian privacy activist Max Schrems, concerned the lawfulness of Facebook’s processing of personal data, specifically around its terms of service.
DPC seeking penalty of up to €36m against Facebook
The Data Protection Commission (DPC) has suggested a penalty of between €28 million and €36 million for Facebook in a draft decision made against the company. Austrian privacy and data rights campaigner Max Schrems’s NOYB organisation, which filed the original complaint against the technology giant, has published the commission’s draft decision online.
