Thanks for you summary! I, for one, needed it. Can you comment on why the BSB found that anonymized IP addresses are personal data (3rd point). Is it because the anonymization is too weak?
Edit: seems GA only masks the last octet of an IP4 address.
Edit: seems GA only masks the last octet of an IP4 address.
More you can find in the NOYB blog post [2]. NOYB is the organization who imitated the complaints towards Google (Analytics).
> While Google has made submissions claiming that has implemented "Technical and Organizational Measures" ("TOMs") [1], which included ideas like having fences around data centers, reviewing requests or having baseline encryption, the DSB has rejected these measures as absolutely useless when it comes to US surveillance (page 38 and 39 of the decision):
> "With regard to the contractual and organizational measures outlined, it is not apparent, to what extent [the measure] are effective in the sense of the above considerations."
> "Insofar as the technical measures are concerned, it is also not recognizable (...) to what extent [the measure] would actually prevent or limit access by U.S. intelligence agencies considering U.S. law."
> Max Schrems: "This is a very detailed and sound decision. The bottom line is: Companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced."
[1] https://noyb.eu/sites/default/files/2021-05/2021-04-09_Respo...
[2] https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...