The Austrian Data Protection Authority issued a decision stating that the GDPR does not permit a risk‑based approach for transfers to insecure third countries such as the United States. It also concluded that Google’s IP anonymisation does not adequately protect personal data transferred via Google Analytics.
Why it matters: The ruling clarifies that GDPR requires full safeguards for EU‑US data transfers, limiting reliance on risk‑based arguments and IP anonymisation.
Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.
