C026 Google LLC, Google Ireland Limited

Online & Mobile tracking
Controller
Google LLC, Google Ireland Limited
Case status
Pending (4 years and more)
Filed: (4 years 7 months ago)

Google LLC argues that the Austrian DPA is not competent for the processing connected to the OS Android, but that this case should be decided by the Irish DPA (DPC), despite the fact that it is filed agains the US entitiy of Google (Google LLC).

Protocol
Дата Summary
24.04.2024
update request to DSB

we asked DSB to provide us with an update since we did not receive any since the BVwG invalidated the DSB's decision to stay the proceeding.

18.12.2023
BVwG lifts suspension by DSB

BVwG also held that the DSB will have to turn to the EDPB under Article 65 GDPR to resolve the negative conflict of competence between DSB and DPC.

Re inactivity, the BVwG held that the decision period for the DSB starts anew now and would be interrupted during a procedure under Article 65 GDPR.

23.10.2023
Letter by BVwG

Google asks for access to case files, we have one week to say if we have objections. We don't.

28.06.2022
Appeal re Aussetzungsbescheid forwarded to BVwG

further communication with BVwG

21.06.2022
DSB Appeal forwarded to BVwG

further communication is with the BVwG

20.05.2022
Appeal against decsion to moot the case until DPC has decided Aussetzungsbescheid
20.05.2022
Appeal against decsion to stop the inactivity procedure
13.05.2022
noyb Call with DSB

noyb called the DSB to get an idea if the DPC's letter changes anything (e.g. the DSB consideres to use Art 56(5) or Art 65(1)(b)) as the DPC apperently won't do anything to handle the case.

The DSB said they will "work on solving this conflict" but didn't specify what they will do. They will not lift their own decisions to moot the case and to end the inactivity procedure.

09.05.2022
DPC Letter to DSB forwarded to noyb

The DPC tells the DSB the DPC will not do anything until noyb/the complainant confirms the DPC's competence as LSA. We will never do that, as
a) DPA competence is not subject to the parties' disposition
b) we do not consider the DPC to be LSA here, as we argue that Google LLC and not Google Ireland is the controller

26.04.2022
DSB Decision to end inactivity procedure

The DSB also passed a decision, ending the inactivity procedure following our inactivity complaint. They are of the view that the decision to give the case to the DPC as assumed LSA is sufficient to end the DSB's inactivity. Hence, the inactivity complaint will never be passed on to the BVwG.

25.04.2022
DSB Decision to moot the case

DSB mooted the case until DPC has issued draft decision. Apparently they see enough hints, that Google Ireland is controller and the DPC is LSA (although the decision contains no proper reasoning).

19.04.2022
Submissions to DSB and DPC following 6 April 2022 communications

AUSTRIA:
(1) Access to missing documents
The documents that determine the controllership over a data subject's personal data can by default not be "confidential", after all this is literally deciding over the rights of the data subject
If there is some confidential elements, then they must be blackened
If we don't get the document, we ask for a formal decision
(2) On the controllership:
We assume that this is (at best) joint controllership
There clearly a joint infrastructure and joint processing of all data, no separation by controller is evident, the separation is purely contractual.
We urge the DPAs to use Article 65 and get this to the EDPB
(3) Submission on the substantive arguments:
New ID. By now the DS had two new phones in the meantime when stuff was sitting at the DPC
Our main point is that there is no "opt in", there is still only an "opt out".
We recognize that Google has given in on the "no deletion" element.

IRELAND:
Repeat (2) [+ "We therefore cannot confirm that Google Ireland is the right entitiy"]
Repeat (3)
Add: We want to inform the DPC that the case is currently before the Austrian Courts on delay, before this was forwarded. Under Austrian law this case needs to be decided or the Court will directly decide. Given previous experiances we do not think that the DPC will be able to do this. The DPC may coordinate with the Austrian DPA on this and/or leave the decision to the Austrian Court.

13.05.2020
Complaint filed