C026 Google LLC, Google Ireland Limited

we asked DSB to provide us with an update since we did not receive any since the BVwG invalidated the DSB's decision to stay the proceeding.

BVwG also held that the DSB will have to turn to the EDPB under Article 65 GDPR to resolve the negative conflict of competence between DSB and DPC.

Re inactivity, the BVwG held that the decision period for the DSB starts anew now and would be interrupted during a procedure under Article 65 GDPR.

Google asks for access to case files, we have one week to say if we have objections. We don't.

further communication with BVwG

further communication is with the BVwG

noyb called the DSB to get an idea if the DPC's letter changes anything (e.g. the DSB consideres to use Art 56(5) or Art 65(1)(b)) as the DPC apperently won't do anything to handle the case.

The DSB said they will "work on solving this conflict" but didn't specify what they will do. They will not lift their own decisions to moot the case and to end the inactivity procedure.

The DPC tells the DSB the DPC will not do anything until noyb/the complainant confirms the DPC's competence as LSA. We will never do that, as
a) DPA competence is not subject to the parties' disposition
b) we do not consider the DPC to be LSA here, as we argue that Google LLC and not Google Ireland is the controller

The DSB also passed a decision, ending the inactivity procedure following our inactivity complaint. They are of the view that the decision to give the case to the DPC as assumed LSA is sufficient to end the DSB's inactivity. Hence, the inactivity complaint will never be passed on to the BVwG.

DSB mooted the case until DPC has issued draft decision. Apparently they see enough hints, that Google Ireland is controller and the DPC is LSA (although the decision contains no proper reasoning).

AUSTRIA:
(1) Access to missing documents
The documents that determine the controllership over a data subject's personal data can by default not be "confidential", after all this is literally deciding over the rights of the data subject
If there is some confidential elements, then they must be blackened
If we don't get the document, we ask for a formal decision
(2) On the controllership:
We assume that this is (at best) joint controllership
There clearly a joint infrastructure and joint processing of all data, no separation by controller is evident, the separation is purely contractual.
We urge the DPAs to use Article 65 and get this to the EDPB
(3) Submission on the substantive arguments:
New ID. By now the DS had two new phones in the meantime when stuff was sitting at the DPC
Our main point is that there is no "opt in", there is still only an "opt out".
We recognize that Google has given in on the "no deletion" element.

IRELAND:
Repeat (2) [+ "We therefore cannot confirm that Google Ireland is the right entitiy"]
Repeat (3)
Add: We want to inform the DPC that the case is currently before the Austrian Courts on delay, before this was forwarded. Under Austrian law this case needs to be decided or the Court will directly decide. Given previous experiances we do not think that the DPC will be able to do this. The DPC may coordinate with the Austrian DPA on this and/or leave the decision to the Austrian Court.