The Regional Court of Munich I has issued an important ruling that sheds more light on the decision of the European Court of Justice on international data transfers (Schrems II): It is the first European court to award a user a claim for damages (in the amount of €100) against a website operator because an IP address was transferred to Google in the United States through the use of the popular web service Google Fonts (judgment of 20 January 2022, case no. 3 O 17493/20).
Background: It has long been recognised that dynamic IP addresses also constitute personal data in the sense of the GDPR. According to the Munich Regional Court, the Google Fonts service transfers the user’s IP address to Google’s parent company in the United States. However, Google does not meet the GDPR requirements for such a data transfer. The result: The data transfer to the United States violates EU privacy law.
It is interesting, however, that the court did not even consider this aspect in its legal reasoning: Rather, according to the court, the use of web font services such as Google Fonts in itself constitutes a privacy violation because the transfer of the IP address can be avoided by hosting the fonts locally and thus cannot be based on a legitimate interest of the website operator in the first place. In other words, because the use of the fonts is also possible without having to establish a connection to Google, the disclosure of the IP address is not justified and thus unlawful.
This argument is highly dubious, since the GDPR does not want to outright prohibit the use of such online services – we live in a society based on the division of labour, in which entrepreneurs resort to the services of third parties to avoid having to reinvent the wheel themselves. At least in this respect, it cannot be assumed that the legal opinion of the Munich Regional Court will prevail. What remains, however, is the problem of illegal international data transfers.
If you use Google Fonts on your website, we recommend that you host the fonts locally, i.e. on your own (Cloud) server. This way, no personal data is transferred to Google and especially not to the United States.
We expect that the issue will continue to be an issue for the courts. Whether we will now see a wave of lawsuits against website operators.