In our July newsletter, we reported on the ruling of the Munich I Regional Court, which had taken up the decision of the European Court of Justice on international data transfers.
For the first time, a European court awarded a user a claim for damages of €100 against a website operator because the user’s IP address was transferred to Google in the US while using the web service Google Fonts (judgment of 20th January 2022, Case No. 3 O 17493/20).
Dynamic IP addresses are considered as personal data according to GDPR. It was determined that the IP address of the user is transferred to Google’s parent company in the US while using Google Fonts. The result: The data transfer to the US violates the GDPR.
The broad aligned recommendation is hosting Google Fonts locally. Hosting Google Font locally no personal data is transferred to Google and thus also not to the US.
Please find detailed instruction on the website of the Interessengemeinschaft Datenschutz.
Back in July, we were concerned that the issue would continue to occupy the courts and that a wave of lawsuits might follow. In fact, a more or less questionable wave of warning letters are going through the country. Law firms are sending warning letters to website operators demanding damages between 100 and 250 euros.
Things get particularly tricky if a user includes their right of access claim as to art. 15 GDPR in the warning letter. You should be particularly careful here, because information must be provided. Otherwise, a GDPR violation would be committed, which would be of interest to the data protection supervisory authorities. If this is the case, please get in touch with our data protection consultans.
However, there are also first counter-decisions, as this judgement of the Baden Baden Regional Court dated 1st Oct. 2022 shows: openjur.de/u/2453079.html