Telecom operators Tele2, Free Mobile and Fastweb are among the over 100 companies facing complaints from the privacy rights group Noyb. The group led by Max Schrems said the companies' websites are still using Google and Facebook code that allows data on users to be sent to the US, despite the EU Court of Justice declaring this illegal a month ago.
Noyb has filed complaints against a total 101 major companies with national data protection regulators in all 30 countries belonging to the EU or European Economic Area. The complaints are also brought against Google and Facebook in the US, for continuing to accept these data transfers, despite them being in violation of the EU's General Data Protection Regulation.
Snippets of code from the sites show they are still using Google Analytics or Facebook Connect to collect information on visitors. "Both companies admit that they transfer data of Europeans to the US for processing, where these companies are under a legal obligation to make such data available to US agencies like the NSA. Neither Google Analytics nor Facebook Connect are essential to run these web pages and are services that could have been replaced or at least deactivated by now," said Schrems, the honorary chair of Noyb.eu.
Google claims it is still relying on the Privacy Shield agreement to transfer personal data between the EU and US, while Facebook uses standard contract clauses to regulate the flows. However, the Court of Justice declared the Privacy Shield invalid under its landmark ruling last month, as the US does uphold the standards of the GDPR. Furthermore, the court said companies using the contract clauses are obliged to ensure the destination of personal data respects EU privacy law - something which is not the case for the US.
Noyb said the court ruling underlined the duty of data protection authorities to intervene and enforce the law, especially when receiving a complaint. They can prohibit the data transfers or even issue fines for serious violations of EUR 20 million or 4 percent of the company's turnover.
The group said it appears companies are ignoring the court ruling. Noyb plans to step up pressure on companies to adapt their policies, and it has also released guidance for smaller companies trying to comply with the ruling. Over time, it also plans to take regulators and policymakers to task for not enforcing the ruling, "like the Irish DPC that stays dormant", it said.
Other companies named in the complaints include Syn, Elisa Estonia, Marktplaats, Roularta Media, Takeaway.com, OE24, RTE, Sky Deutschland, Zoznam, Hotnews.ro, Handelsblatt, Delo and Onet-RAS Polska. Major retailers such as Auchan, Decathlon, Bpost, Sephora, Ikea, Coop Sweden and Danske Bank were also covered by the complaints.
