BVwG: B2B email via Mailchimp violated GDPR Art. 44 (US transfer without valid safeguards)

Date of Decision September 11, 2026 Legal Provision B-VG Art. 133, para. 4 GDPR Art. 4, point 7 GDPR Art. 44 GDPR Art. 45 GDPR Art. 46 GDPR Art. 49 B-VG Art. 133 (current version) B-VG Art. 133 effective from January 1, 2019, through May 24, 2018, last amended by BGBl. I No. 138/2017 B-VG Art. 133 effective as of January 1, 2019, last amended by Federal Law Gazette I No. 22/2018 B-VG Art. 133 effective from May 25,May 2018 through December 31, 2018; last amended by Federal Law Gazette I No. 22/2018; B-VG Art. 133; effective from August 1, 2014, through May 24,2018, last amended by Federal Law Gazette I No. 164/2013, B-VG Art. 133, effective from Jan. 1, 2014, through July 31, 2014, last amended by Federal Law Gazette I No. 51/2012 B-VG Art. 133 effective from Jan. 1, 2004, through Dec. 31, 2013, last amended by Federal Law Gazette I No. 100/2003 B-VG Art. 133 effective from January 1, 1975, through December 31, 2003, last amended by Federal Law Gazette No. 444/1974 B-VG Art. 133 valid from Dec. 25, 1946, through Dec. 31, 1974, last amended by Federal Law Gazette No. 211/1946 B-VG Art. 133 valid from Dec. 19,December 1945 through December 24, 1946; last amended by State Law Gazette No. 4/1945; B-VG Art. 133; in effect from January 3, 1930, through June 30, 1934 Decision , W256 2280818-2/14E IN THE NAME OF THE REPUBLIC!

The Federal Administrative Court, composed of Judge Mag. Caroline Kimm as presiding judge, as well as expert lay judge Dr. Claudia Rosenmayr-Klemenz and the expert lay judge Mag. Matthias Schachner as associate judges, rules as follows on the complaint filed by Mag. XXXX regarding the Data Protection Authority’s failure to fulfill its duty to decide on his complaint lodged on January 11, 2022, against XXXX:The Federal Administrative Court, presided over by Judge Mag. Caroline Kimm, with expert lay judge Dr. Claudia Rosenmayr-Klemenz and expert lay judge Mag. Matthias Schachner as associate judges, has ruled correctly on the appeal filed by Mag. Roman 40 regarding the Data Protection Authority’s failure to fulfill its duty to decide on his complaint lodged on January 11, 2022, against Roman 40: A) The data protection complaint of January 11, 2022, is upheld, and it is determined that the respondent, as the controller, by sending the complainant a newsletter via email on January 5, 2022, using the U.S. service provider Mailchimp —and thereby transferring his personal data (first and last name, company name, email address) to Mailchimp—the respondent, as the data controller, violated the provisions governing the transfer of personal data to third countries pursuant to Art. 44 et seq. of the GDPR.A) The data protection complaint dated January 11, 2022, is upheld, and it is determined that the respondent, as the controller, violated the provisions governing transfers of personal data to third countries pursuant to Article 44 et seq. of the GDPR by sending the complainant a newsletter via email on January 5, 2022, using the U.S.-based service provider Mailchimp —and thereby transferring his personal data (first and last name, company name, email address) to Mailchimp—the respondent, as the data controller, violated the provisions governing transfers of personal data to third countries pursuant to article 44 et seq. of the GDPR.

B) The appeal is not admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG).B) The appeal is not admissible pursuant to Article 133(4) of the Federal Constitutional Law (B-VG). Text Reasons for the Decision: I. Proceedings: Roman numeral I. Proceedings: In a letter dated January 11, 2022, addressed to the respondent authority, the complainant filed a “request for review” with the Data Protection Authority regarding an unlawful data transfer under Article 44 et seq. of the GDPR. The controller in this case, XXXX (hereinafter: “controller” or “respondent”), uses the U.S. service provider “Mailchimp”—a tool of the U.S. enterprise “Rocket Science Group, LLC,” 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA, and sent an email to the complainant on January 5, 2022, at 3:54 p.m.—which is attached to the complaint. At least since the CJEU judgement in Case C-311/18—Schrems II—the transfer of personal data to a U.S. provider such as Mailchimp without an appropriate legal basis has been unlawful.

The server location is irrelevant. This is because, after the CJEU declared the “EU-U.S. Privacy Shield” invalid, the controller can no longer base the data transfer to Mailchimp on an adequacy decision pursuant to Art. 45 of the GDPR. Nor would the SCCs that Mailchimp makes available to its customers do not provide a sufficient basis, since the controller is not at all able—due to U.S. surveillance laws such as the CLOUD Act or FISA—to adequately protect the personal data of Austrian recipients or to guarantee that U.S. authorities and/or intelligence agencies cannot gain access to the personal data. The complainant has not given consent for this data transfer. The controller is completely unknown to the complainant; there had been no prior contact whatsoever. Since the controller transferred the complainant’s personal data to the United States without an adequate legal basis, the complainant’s rights have been violated .

The complainant therefore requests that the Data Protection Authority review the use of the U.S. service provider Mailchimp to determine whether there is a sufficient legal basis for this. The complainant does not seek punishment of the controller, but rather a determination that the data transfer by the authority in question was unlawful. In a letter dated January 11, 2022, addressed to the respondent authority, the complainant filed a “request for review” with the Data Protection Authority regarding an unlawful data transfer pursuant to article 44 et seq. of the GDPR. The controller in this proceeding, Roman numeral 40 (hereinafter: “controller” or “respondent”), uses the U.S. service provider “Mailchimp”—a tool of the U.S. enterprise “Rocket Science Group, LLC,” 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA, and sent an email to the complainant on January 5, 2022, at 3:54 p.m.—which is attached to the complaint.

At least since the CJEU judgement in Case C-311/18—Schrems II—the transfer of personal data to a U.S. provider such as Mailchimp without an appropriate legal basis has been unlawful. The server location is irrelevant. This is because, after the CJEU declared the “EU-U.S. Privacy Shield” invalid, the controller can no longer base the data transfer to Mailchimp on an adequacy decision pursuant to article 45 of the GDPR. Nor would the SCCs that Mailchimp makes available to its customers do not provide a sufficient basis, since the responsible enterprise is not at all able—due to U.S. surveillance laws such as the CLOUD Act or FISA—to adequately protect the personal data of Austrian recipients or to guarantee that U.S. authorities and/or intelligence agencies cannot gain access to the personal data. The complainant has not given consent for this data transfer. The controller is completely unknown to the complainant; there had been no prior contact whatsoever.

Since the controller transferred the complainant’s personal data to the United States without an adequate legal basis, the complainant’s rights have been violated . The complainant therefore requests that the Data Protection Authority review the use of the U.S. service provider Mailchimp to determine whether there is a sufficient legal basis for this. The complainant does not seek punishment of the controller, but rather a determination that the data transfer by the respondent authority was unlawful. As can be seen from an email dated January 18, 2022, from a case worker at the respondent agency included in the file, the respondent agency initiated an ex officio review proceeding based on this submission and recorded it under file number D213.1544. This proceeding was—as is also evident from the email—dismissed by means of a file note. The respondent authority did not initiate a complaint proceeding under § 24 DSG based on the complainant’s submission of January 11, 2022.

Mailchimp is used by countless enterprises worldwide, including in the EU; - familiarized itself with Mailchimp’s corporate policy regarding data protection: after the CJEU declared the EU-U.S. Privacy Shield invalid in the “Schrems II” case, the SCCs remained valid as long as the level of data protection was equivalent to that in the EU. Mailchimp implements the European Commission’s updated SCCs of June 4, 2021, as the legal basis for data transfers and takes additional technical and organizational data protection measures. Mailchimp also regularly publishes transparency reports; - ensured that no confidential data was transferred to Mailchimp; such data consisted only “of the company name, the email address, the first and last names of the managing director, and, if applicable, the IP address.” At the request of the investigating authority, the respondent submitted a further statement by letter dated March 21, 2024, as follows: At the time the data was transferred to Mailchimp, the SCCs proposed by the European Commission in 2010, pursuant to Article 46(2)(c) of the GDPR, had been concluded between Mailchimp and the respondent.

As supplementary measures in accordance with the “Schrems II” judgement, specific safeguards had been agreed upon with Mailchimp:At the time the data was transferred to Mailchimp, the 2010 SCCs proposed by the European Commission, in accordance with article 46(2)(c) of the GDPR, had been concluded between Mailchimp and the company. As supplementary measures in accordance with the “Schrems II” judgement, specific safeguards were agreed upon with Mailchimp: Additional contractual measures: ● Security, confidentiality, and auditing: The SCCs incorporated into its contracts with Mailchimp are supplemented by detailed obligations regarding the security and confidentiality of data processing. These include, among other things, measures against unauthorized data transfers and promote cooperation regarding the rights of data subjects. Of particular note are the agreed-upon audit rights and transparency clauses, which would require Mailchimp to provide insight into how it handles government requests and to allow for regular reviews of its data protection standards. ● Commitment to Take Specific Measures in Response to Government Orders: Mailchimp has committed to critically reviewing every government order regarding data disclosure in order to protect the rights of data subjects.

Additional Technical Measures: ● Data Protection and Data Security: Mailchimp has demonstrated its commitment to data protection and data security through comprehensive technical and organizational measures. The implementation of encryption technologies across its entire infrastructure and strict access controls protect data from unauthorized access. Adherence to high security standards is further demonstrated by Mailchimp’s compliance with SOC 2 Type II and PCI DSS certification. These certifications, supported by regular external audits, confirm Mailchimp’s commitment to robust security measures and data protection practices.● Data Protection and Data Security: Mailchimp has demonstrated its commitment to data protection and data security through comprehensive technical and organizational measures. The implementation of encryption technologies throughout its infrastructure and strict access controls protect data from unauthorized access.

Adherence to high security standards is further demonstrated by Mailchimp’s compliance with SOC 2 Type II and PCI DSS certification. These certifications, supported by regular external audits, confirm Mailchimp’s commitment to high security measures and data protection practices. Additional organizational measures: ● Internal directives for data transfers and employee training: Mailchimp is committed to establishing internal directives for handling government requests for data access. This includes, among other things, regular employee training aimed at strengthening awareness and understanding of customer data protection. ● Data minimisation: To further minimize the risk of exposing personal data to unauthorized access, Mailchimp consistently applies the principle of data minimisation. This means that only the most necessary personal data is collected and processed for the intended purpose. ● Proactive surveillance: It regularly reviews Mailchimp’s data protection and security practices.

This includes regularly reviewing Mailchimp’s Data Processing Agreements (DPAs) to ensure that it is informed of any changes and that Mailchimp consistently meets data protection requirements. In addition, it regularly evaluates Mailchimp’s transparency reports, which provide important insights into how requests from government authorities are handled. At the request of the authority in question, the complainant submitted a statement on this matter in a letter dated April 2, 2024: There are numerous alternatives to Mailchimp. The agreed-upon SCCs do not provide data subjects with sufficient protection because an American enterprise such as Mailchimp is subject to U.S. laws, which grant U.S. authorities the right to request or access data from European citizens held by U.S. enterprises. Furthermore, European citizens have no effective appeals available to them, nor are they likely to be informed of such access, which constitutes a clear incompatibility with the GDPR.

In a letter dated April 18, April 2025, the Federal Administrative Court requested the respondent to comment within three weeks on the complainant’s statement of April 2, 2024, to address the questions specified in detail, and to submit evidence if necessary. On May 26, 2025, the Court urged the respondent to submit a statement. In a brief dated May 22, 2025, received by the Court on May 30, 2025, the respondent submitted the following statement: Aware of the CJEU judgement in the “Schrems II” case, it had conducted a risk assessment, taking into account the nature of the transferred data (publicly available, business contact information), the specific purpose (a one-time B2B contact to present its video production services), and the measures implemented by Mailchimp. Contractually, Mailchimp had committed to processing the personal data only on behalf of and in accordance with the instructions of the data exporter.

Mailchimp has committed to immediately informing the data exporter if the instructions or obligations under the agreed clauses cannot be complied with, including due to U.S. laws; in such a case, the respondent would have been entitled to suspend the data transfer or terminate the contract. Mailchimp was also obligated to promptly inform the data exporter of legally binding access requests from law enforcement authorities, unless prohibited by law. Upon receiving a mandatory request, Mailchimp had undertaken to attempt to refer the authority to the respondent and to notify the respondent of the request, unless this was prohibited by law or there was a risk of serious harm. Mailchimp also published annual transparency reports on the number and Art of government requests it received. Mailchimp uses encryption technologies that, while not offering protection against lawful U.S. access, do protect against unauthorized access by third parties.

There are strict access controls and restrictions in place for Mailchimp staff and third parties regarding the internal infrastructure. Mailchimp has undergone regular external security audits. The data centers in the U.S. have physical security measures in place, and employees receive regular training on security practices. As a data exporter, the respondent also ensured strict data minimisation: Only publicly available, business contact information necessary for the specific purpose of establishing contact was transferred. No sensitive or private data was transferred. Given the nature of the data, its limited scope, and the specific purpose, the risk of harmful access by U.S. authorities was assessed as low. It was assumed that the interest of U.S. security authorities in this type of data for this specific purpose was negligible. Mailchimp itself had admitted that, as an “electronic communication service,” it could technically be the recipient of FISA directives.

However, the measures taken by Mailchimp and the respondent were aimed at minimizing the risk of such access and limiting its scope. Finally, the respondent points out that Mailchimp has been certified under the EU-U.S. Data Privacy Framework since July 10, 2023, which constitutes an adequacy decision under Article 45 of the GDPR for current and future data transfers. This underscores the service provider’s ongoing efforts to comply with European data protection standards. Although Mailchimp itself has acknowledged that, as an “electronic communication service,” it could technically be subject to FISA directives, However, the measures taken by Mailchimp and the respondent were aimed at minimizing the risk of such access and limiting its scope. Finally, the respondent points out that Mailchimp has been certified under the EU-U.S. Data Privacy Framework since July 10, 2023, which constitutes an adequacy decision under article 45 of the GDPR for current and future data transfers.

This underscores the service provider’s ongoing efforts to comply with European data protection standards. In a letter filed with the Court on June 2, 2025, the respondent essentially reiterated its previous arguments. In a statement dated June 7, 2025, the complainant further argued that his IP address had been transmitted to Mailchimp via the “Tracking pixel” used to detect when an email was opened and via the “Tracking links,” from which additional personal data such as location, the date and time of opening, and content-related interests. Second, Mailchimp was able to use the email address to create a comprehensive profile of him based on its entire database, which is why his rights and freedoms were severely affected. Furthermore, the guarantees cited by the respondent—which were agreed upon with Mailchimp—are ineffective insofar as Mailchimp, as an American enterprise, is in any case subject to American law.

II. The Federal Administrative Court considered: II. The Federal Administrative Court considered: 1. Findings: The respondent is a sole proprietor who operates as a professional photographer. On January 5, 2022, as part of her enterprise operations, the respondent sent a newsletter to the complainant—a business owner and potential customer—for direct marketing purposes, using Mailchimp as the email service provider. In doing so, the following data regarding the complainant was transmitted to Mailchimp: first and last name, company name, and email address. This data was publicly available. Mailchimp is a B2B email marketing platform based in the United States and is considered an “electronic communications service” under U.S. law. The U.S. government is therefore authorized under Section 702 of the FISA Amendments Act and Executive Order 12333 to issue mandatory requests to Mailchimp for the disclosure of information, including for intelligence purposes.

The actual disclosure of information on such a basis occurs several times a year (in the single-digit range). On January 5, 2022, the standard data protection clauses 2010 (pursuant to European Commission Implementing Decision 2010/87/EU of February 5, 2010, on SCCs for the transfer of personal data to processors in third countries pursuant to Directive 95/46/EC of the European Parliament and of the Council, OJ L 2010/39, p. 5). On January 5, 2022, the standard data protection clauses 2010 (pursuant to European Commission Implementing Decision 2010/87/EU of February 5, 2010, on SCCs for the transfer of personal data to processors in third countries pursuant to Directive 95/46/EC of the European Parliament and of the Council, Official Journal L 2010/39, p. 5). In addition, the following measures were agreed upon between the respondent and Mailchimp: Additional contractual measures: These included, among other things, audit rights and transparency clauses that required Mailchimp to provide insight into how it handled government requests and to allow for regular reviews of its data protection standards.

Mailchimp had committed to critically reviewing any government order requiring data disclosure in order to protect the rights of the data subjects. Mailchimp was obligated to process personal data only on behalf of and in accordance with the respondent’s instructions and to inform the respondent immediately if these could not be complied with. In such a case, the respondent could have suspended the data transfer or terminated the contract. Mailchimp was also required to inform the respondent of any legally binding access requests from law enforcement agencies, unless doing so was prohibited by law. Mailchimp was also obligated to attempt to refer the requesting authority to the respondent and to notify the respondent of the request, unless this was prohibited by law or there was a risk of serious harm. Additional technical measures: Mailchimp had implemented encryption technologies throughout its infrastructure, with strict access controls protecting the data from unauthorized access.

In addition, Mailchimp was compliant with SOC 2 Type II and held PCI DSS certification. Mailchimp underwent regular security audits. Mailchimp had implemented encryption technologies throughout its infrastructure, with strict access controls protecting the data from unauthorized access. Furthermore, Mailchimp was compliant with SOC 2 Type II and held PCI DSS certification. Mailchimp underwent regular security audits. Additional organizational measures: Mailchimp had committed to establishing internal directives for handling government requests for data access. This included, among other things, regular employee training to strengthen awareness and understanding of customer data protection. 2. Assessment of the Evidence: The respondent’s business license is documented in the publicly accessible business registry. The fact that the respondent sent the complainant the newsletter in question via Mailchimp on January 5, 2022, and that the enterprise that sent the newsletter processed the complainant’s identified data in the process, is evident from the submitted administrative record and is undisputed.

The scope of the data transmitted is evident from the respondent’s statement dated March 5, 2024. The complainant did not dispute that his data was publicly accessible. The findings regarding Mailchimp and the U.S. government’s ability to access information are based on the information published by Mailchimp on its enterprise website, “Mailchimp and European Data Transfers” in the version available on January 4, 2022, as is unequivocally evident from the appendix to the respondent’s statement of March 21, 2024. The appendix to the response dated March 5, 2024, also shows that Mailchimp is in fact required to disclose information to U.S. authorities several times a year. The fact that the standard data protection clauses 2010 and the supplementary measures were contractually agreed upon between the respondent and Mailchimp is evident from the respondent’s undisputed submissions. 3. Legal Assessment: Re A) 3.1.

The Federal Administrative Court must therefore, following the resubmission of the case file by the respondent authority after the expiration of the eight-week decision period, now rule on the merits of the case itself (Section 28, paragraph 7, last sentence, VwGVG). 3.2. In the present case, it is undisputed that the respondent, as the controller within the meaning of Article 4(7) of the GDPR, carried out a transfer of the complainant’s personal data (first and last name, company name, email address) to the United States. The complainant is filing this complaint to object to this transfer of his personal data to a third country. 3.2. In the present case, it is undisputed that a transfer of the complainant’s personal data (first and last name, company name, email address) by the respondent, as the controller within the meaning of Article 4(7) of the GDPR, to the United States. The complainant is filing this complaint to object to this transfer of his data to a third country.

Chapter V of the GDPR governs transfers of personal data to third countries or to international organisations. Chapter V of the GDPR governs transfers of personal data to third countries or to international organisations. Pursuant to Article 44 of the GDPR, a transfer to a third country is generally permissible only if the controller or processor complies with the conditions set forth in Chapter V and the other provisions of the GDPR are also observed. The level of protection guaranteed by the GDPR must not be undermined.Pursuant to Article 44 of the GDPR, a transfer to a third country is generally permissible only if the controller or processor complies with the conditions set forth in Chapter V and the other provisions of the GDPR are also complied with. The level of protection guaranteed by the GDPR must not be undermined. Pursuant to Article 45 of the GDPR, a transfer within the meaning of Article 44 of the GDPR may be carried out if the Commission has decided that the third country in question, a territory or one or more specific sectors within that third country, or the international organisation in question, provides an adequate level of protection.

Such a data transfer does not require specific authorization.Pursuant to Article 45 of the GDPR, a transfer within the meaning of Article 44 of the GDPR may be carried out if the Commission has decided that the third country in question, a territory or one or more specific sectors within that third country, or the international organisation in question provides an adequate level of protection. Such a data transfer does not require specific authorization. In the absence of a decision within the meaning of Article 45 of the GDPR, pursuant to Article 46 of the GDPR, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards and if data subjects have enforceable rights and effective legal remedies.In the absence of a decision within the meaning of Article 45 of the GDPR, pursuant to Article 46, GDPR, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards and if data subjects have enforceable rights and effective legal remedies available to them.

Article 49 of the GDPR provides that, in the absence of an adequacy decision within the meaning of Article 45 of the GDPR or no appropriate safeguards within the meaning of Article 46 of the GDPR, that a transfer or a series of transfers of personal data to a third country or an international organisation is permitted only under certain, specifically defined conditions.Article 49 of the GDPR provides that, in the absence of an adequacy decision within the meaning of Article 45 of the GDPR or appropriate safeguards within the meaning of Article 46 of the GDPR, that a transfer or a series of transfers of personal data to a third country or an international organisation is permitted only under certain, specifically defined conditions. According to Guidelines 5/2021 of the European Data Protection Board on the interplay between the application of Article 3 and the provisions on international transfers under Chapter V of the GDPR (Version 2.0, February 14, 2023; as amended (“Guidelines”), there are three cumulative criteria that can be used to determine whether a processing operation constitutes a transfer within the meaning of Chapter V of the GDPR: (i) a controller or processor (exporter) is subject to the GDPR with respect to the processing in question, (ii) the exporter discloses personal data that is the subject of this processing to another controller, joint controller, or processor (“importer”) through transfer or by other means, (iii) the importer is located in a third country, regardless of whether that importer is subject to the GDPR with respect to the processing in question pursuant to article 3 of the GDPR, or the importer is an international organisation.According to Guideline 5 of 2021 on the interplay between the application of article 3 and the provisions on international transfers under Chapter V of the GDPR issued by the European Data Protection Board (Version 2.0, February 14, 2023; hereinafter referred to as the “Guidelines”), there are three cumulative criteria that can be used to determine whether a processing operation constitutes a transfer within the meaning of Chapter V of the GDPR: (i) a controller or processor (exporter) is subject to the GDPR with respect to the processing in question, (ii) the exporter discloses personal data that is the subject of this processing to another controller, joint controller, or processor (“importer”) through transfer or by other means, (iii) the importer is located in a third country, regardless of whether that importer is subject to the GDPR with respect to the processing in question pursuant to article 3 of the GDPR, or the importer is an international organisation.

Article 8(1) of the EU CFR establishes an obligation to maintain the level of protection provided under Union law (CJEU, Oct. 6, 2015, C-362/14 (Schrems I), para. 72). The provisions in question govern the conditions under which a controller or processor (exporter) may transfer personal data to a third country. The term “transfer,” which is not legally defined, must be understood in the context of Articles 44 et seq. in relation to the purpose of protection. It therefore encompasses any disclosure of personal data to an entity outside the territory of the European Union or to an international organisation (Kühling/Buchner, GDPR·BDSG3, Art. 44, para. 16; Jahnel, Commentary on the General Data Protection Regulation, Art. 44 GDPR (as of Dec. 1, 2020, rdb.at), para. 18).Article 8(1) of the EU CFR establishes an obligation to maintain the level of protection provided under EU law (CJEU, Oct. 6, 2015, C-362/14 (Schrems I), para. 72).

The provisions in question govern the conditions under which a controller or processor (exporter) may transfer personal data to a third country. The term “transfer,” which is not legally defined, must be understood in the context of Articles 44 et seq. in relation to the purpose of protection. It therefore encompasses any disclosure of personal data to an entity outside the territory of the European Union or to an international organisation (Kühling/Buchner, GDPR·BDSG3, article 44, para. 16; Jahnel, Commentary on the General Data Protection Regulation, article 44, GDPR (as of Dec. 1, 2020, rdb.at), para. 18). In its decision C-311/18 of July 16, 2020 (Schrems II), the CJEU addressed Chapter V of the GDPR and the question of under what conditions a transfer of personal data to third countries is permissible. Both the CJEU’s judgement and the facts of the case at issue concern a data transfer to the United States.

In its decision C-311/18 of July 16, 2020 (Schrems II), the CJEU addressed Chapter V of the GDPR and the question of under what conditions the transfer of personal data to third countries is permissible. Both the CJEU’s judgement and the facts of the case at hand concern a data transfer to the United States. The request for a preliminary ruling in Case C-311/18 concerned, on the one hand, the interpretation of Art. 3(2), 25, 26, and 28(3) of Directive 95/46/EC in light of Article 4(2) of the TEU as well as Articles 7, 8, and 47 of the CFR. On the other hand, it concerned the interpretation and validity of Decision 2010/87/EU on SCCs as well as the interpretation and validity of Implementing Decision (EU) 2016/1250 on the adequacy of the protection provided by the EU-U.S. Privacy Shield (DSS Decision). The request for a preliminary ruling in Case C-311/18 concerned, on the one hand, the interpretation of article 3, paragraph 2, 25, 26, and 28(3) of Directive 95/46/EC in light of article 4(2) of the TEU and articles 7, 8, and 47 of the CFR.

On the other hand, it concerned the interpretation and validity of Decision 2010/87/EU on SCCs, as well as the interpretation and validity of Implementing Decision (EU) 2016/1250 on the adequacy of the protection provided by the EU-U.S. Privacy Shield (Privacy Shield Decision). The judgement stemmed from an appeal proceeding before the High Court of Ireland, in which the appellant essentially argued that the Commission’s SCT Decision did not provide adequate protection for personal data against access by U.S. authorities within the meaning of Articles 7, 8, and 47 of the CFR. Consequently, EU citizens did not enjoy the same rights as U.S. citizens. The judgement stemmed from an appeal proceeding before the High Court of Ireland, in which the appellant essentially argued that the Commission’s SDK decision did not provide adequate protection for personal data against access by U.S. authorities within the meaning of Articles 7, 8, and 47 of the CFR.

Consequently, EU citizens do not have the same rights as U.S. citizens. It follows from the judgement that data transfers from the EU to other EU countries are, in principle, subject to the GDPR, even if the data may be processed abroad for purposes of public security, national defense, and national security (para. 89). With regard to the level of protection that must be ensured in the case of a data transfer within the meaning of Art. 46(1) and (2)(c) of the GDPR, the CJEU stated that Although Art. 46 of the GDPR does not specify the nature of the requirements arising from the reference to “appropriate safeguards,” “enforceable rights,” and “effective legal remedies,” the level of protection guaranteed by the GDPR must not be undermined. The level of protection in the third country need not be identical to that of the Union legal order, but must, in light of the national legal order, offer protection equivalent to that of the GDPR in light of the CFR.

In making the assessment required in this regard in connection with such a transfer, particular consideration must be given to the contractual provisions agreed upon between the controller or its processor established in the Union and the recipient of the transfer established in the third country in question, as well as, with regard to any access by the authorities of that third country to the transferred personal data, the relevant elements of that country’s legal system (para. 90 et seq.).With regard to the level of protection that must exist in the case of a data transfer within the meaning of Article 46, paragraph 1 and paragraph 2(c) of the GDPR, the CJEU stated that Article 46, GDPR does not specify the Art of the requirements arising from the references to “appropriate safeguards,” “enforceable rights,” and “effective legal remedies,” the level of protection guaranteed by the GDPR must not be undermined.

The level of protection in the third country need not be identical to that of the Union legal order, but must, in light of the national legal order, offer protection equivalent to that of the GDPR in light of the CFR. In the assessment required in this regard in connection with such a transfer, particular consideration must be given to the contractual provisions agreed upon between the controller or its processor established in the Union and the recipient of the transfer established in the third country in question, as well as, with regard to any access by the authorities of that third country to the transferred personal data, the relevant elements of that country’s legal system (para. 90 et seq.). With regard to the SDK decision, the Court of Justice held that it is undisputed that the standard data protection clauses cannot take effect vis-à-vis the authorities of a third country, since they are not parties to the contract.

In this respect, the standard data protection clauses may or may not guarantee sufficient data protection under the national legal system of the third country. This is the case, for example, if the law of the third country permits its authorities to interfere with the rights of data subjects regarding such data. However, the safeguards to which a data subject is entitled under Article 46(1) of the GDPR do not necessarily have to be provided for in a Commission decision such as the SDK Decision. In this respect, such a decision differs from an adequacy decision adopted pursuant to Article 45(3) of the GDPR, which aims to – following an examination of the law of the third country in question, taking into account, in particular, the relevant provisions in the areas of national security and government access to personal data – to establish, in a binding manner, that a third country, a territory, or one or more specific sectors within that third country, offers an adequate level of protection, such that the access of that country’s public authorities to such data does not preclude its transfer to that country.

In this respect, it cannot be inferred from Article 46 of the GDPR that the Commission would be obligated to assess the adequacy of the third country’s level of protection prior to adopting standard data protection clauses. In the absence of an adequacy decision, it is therefore up to the data exporter—the controller established in the EU—to provide appropriate safeguards. In this regard, it may be necessary to supplement the standard data protection clauses with additional safeguards (para. 122 et seq.).With regard to the SDP decision, the Court of Justice held that it is undisputed that the standard data protection clauses cannot take effect vis-à-vis the authorities of a third country, as they are not parties to the agreement. In this respect, the standard data protection clauses may or may not guarantee adequate data protection under the national legal system of the third country. This is the case, for example, if the law of the third country permits its authorities to interfere with the rights of data subjects regarding such data.

However, the safeguards to which a data subject is entitled under Article 46(1) of the GDPR do not necessarily have to be provided for in a Commission decision such as the SDK Decision. In this respect, such a decision differs from an adequacy decision adopted pursuant to Article 45(3) of the GDPR, which aims—following an examination of the law of the third country in question, taking into account in particular the relevant provisions in the areas of national security and government access to personal data—to determine in a binding manner that a third country, a territory, or one or more specific sectors within that third country, offers an adequate level of protection, such that the access of that country’s public authorities to such data does not preclude its transfer to that country. In this respect, it cannot be inferred from article 46 of the GDPR that the Commission would be obligated to assess the adequacy of the third country’s level of protection prior to adopting standard data protection clauses.

In the absence of an adequacy decision, it is therefore the responsibility of the controller based in the EU that is exporting the data to provide appropriate safeguards. In this regard, it may be necessary to supplement standard data protection clauses with additional safeguards (para. 122 et seq.). Finally, the Court of Justice examined the Commission’s DSS decision in greater detail, addressing in particular the concerns raised by the referring Court that the legal protection afforded to data subjects vis-à-vis U.S. authorities is not equivalent to that provided under Union law. In response to a request from the Court of Justice, the U.S. government acknowledged that Presidential Policy Directive 28 (“PPD-28”), which, among other things, governs the procedures by which U.S. authorities access data, does not confer upon data subjects any rights that could be enforced in court against those authorities.

Similarly, Executive Order 12333, which is relevant to data processing, does not confer upon data subjects any rights with respect to surveillance programs conducted by U.S. authorities that could be enforced in Court. Overall, it must be assumed that neither Section 702 of the FISA nor Executive Order 12333, in conjunction with PPD-28, satisfies the minimum requirements established under EU law in accordance with the principle of proportionality, so that it cannot be assumed that the surveillance programs based on these provisions are limited to what is strictly necessary and are therefore not compatible with Article 52(1), second sentence, of the CFR. The establishment of an ombudsman mechanism dealing with data protection issues was unable to remedy this deficiency (para. 150 et seq.). The CJEU therefore declared the then-existing adequacy decision for data transfers to the United States (“Privacy Shield”) invalid with immediate effect, meaning that it does not apply to the data processing at issue.Finally, the Court examined the Commission’s DSS decision in greater detail, focusing in particular on the concerns raised by the referring Court, namely that the legal protection afforded to data subjects vis-à-vis U.S. authorities is not equivalent to that provided under Union law.

In response to a request from the Court of Justice, the U.S. government acknowledged that Presidential Policy Directive 28 (“PPD-28”), which, among other things, governs the procedures by which U.S. authorities access data, does not confer upon data subjects any rights that could be enforced in court against those authorities. Similarly, Executive Order 12333, which is relevant to data processing, does not confer upon data subjects any rights with respect to surveillance programs conducted by U.S. authorities that could be enforced in Court. Overall, it must be assumed that neither Section 702 of the FISA nor E.O. 12333, in conjunction with PPD-28, meets the minimum requirements established under EU law pursuant to the principle of proportionality, so that it cannot be assumed that the surveillance programs based on these provisions are limited to what is strictly necessary, and are therefore incompatible with article 52, paragraph 1, sentence 2 of the CFR.

The creation of an ombudsman mechanism dealing with data protection issues was unable to remedy this shortcoming (para. 150 et seq.). The CJEU therefore declared the then-existing adequacy decision for data transfers to the United States (“Privacy Shield”) invalid with immediate effect, meaning that it does not apply to the data processing at issue. With Implementing Decision (EU) 2023/1795 of July 10, 2023, the Commission adopted the “Data Privacy Framework” and, with it, a new adequacy decision within the meaning of Article 45(3) of the GDPR regarding data transfers to the United States. However, this decision is irrelevant to the present proceedings, as it was adopted after the data processing at issue in these proceedings took place.By Implementing Decision (EU) 2023/1795 of July 10, 2023, the Commission adopted the “Data Privacy Framework” and thereby issued a new adequacy decision within the meaning of article 45, paragraph 3, GDPR regarding data transfers to the United States.

However, this decision is irrelevant to the present proceedings, as it was adopted after the data processing at issue in these proceedings took place. Pursuant to Article 46(1) of the GDPR, where there is no adequacy decision by the Commission within the meaning of Article 45(3) of the GDPR, a controller may transfer personal data to a third country only if appropriate safeguards are in place and data subjects have enforceable rights and effective legal remedies. Para 2 and 3 of Article 46 of the GDPR then provide for measures that may constitute appropriate safeguards. Pursuant to Article 46, paragraph 1, of the GDPR, a controller may, in the absence of an adequacy decision by the Commission within the meaning of Article 45, paragraph 3, GDPR, a controller may transfer personal data to a third country only if appropriate safeguards are in place and data subjects have enforceable rights and effective legal remedies.

Paragraphs 2 and 3 of article 46 of the GDPR then provide for measures that may constitute appropriate safeguards. Article 46(2)(c) of the GDPR stipulates that standard data protection clauses adopted by the Commission in accordance with the examination procedure under Article 93(2) of the GDPR may constitute appropriate safeguards. Article 46(2)(c) of the GDPR provides that standard data protection clauses adopted by the Commission in accordance with the examination procedure under Article 93(2) of the GDPR may constitute appropriate safeguards. In the aforementioned judgement of the CJEU dated July 16, 2020 (Schrems II), the Court stated that, in principle, standard data protection clauses are not objectionable as an instrument for international data transfers to third countries; it also pointed out that standard data protection clauses are of a contractual nature and therefore cannot be binding on third parties or, in particular, public authorities (see para. 126).

Rather, what matters is an overall assessment of the appropriate safeguards and whether, under certain circumstances, additional safeguards exist alongside the standard data protection clauses. It must be assumed that the standard data protection clauses adopted by the Commission pursuant to Art. 46(2)(c) of the GDPR are intended solely to provide contractual guarantees to controllers established in the Union or to their processors established there, which apply uniformly in all third countries, i.e., regardless of the level of protection guaranteed in each such country. Since these standard data protection clauses, by their very nature, cannot provide safeguards that go beyond the contractual obligation to ensure compliance with the level of protection required under Union law, it may be necessary, depending on the situation in a particular third country, for the controller to take additional measures to ensure compliance with this level of protection (see para. 133).In the aforementioned judgement of the CJEU dated July 16, 2020 (Schrems II), the Court stated that, in principle, standard data protection clauses are not objectionable as an instrument for international data transfers to third countries; it also pointed out that standard data protection clauses are contractual in nature and therefore cannot be binding on third parties or, in particular, public authorities (see para. 126).

Rather, what matters is an overall assessment of the appropriate safeguards and whether, under certain circumstances, additional safeguards exist alongside the standard data protection clauses. It must be assumed that the standard data protection clauses adopted by the Commission pursuant to Article 46(2), paragraph 2, (c) of the GDPR are intended solely to provide controllers established in the Union—or their processors established there—with contractual safeguards that apply uniformly in all third countries, i.e., regardless of the level of protection guaranteed in each respective country. Since these standard data protection clauses, by their very nature, cannot provide safeguards that go beyond the contractual obligation to ensure compliance with the level of protection required under Union law, depending on the situation in a particular third country, the controller may need to take additional measures to ensure compliance with that level of protection (see para. 133).

Finally, it follows from Recommendation 01/2020 of the European Data Protection Board (EDPB) that U.S. law and practice must be assessed to determine whether a level of protection consistent with the GDPR is ensured during the transfer. According to the Data Protection Board, the likelihood of access should not be the determining factor in this assessment.Finally, it follows from Recommendation 01/2020 of the European Data Protection Board (EDPB) that U.S. law and practice must be assessed to determine whether a level of protection consistent with the GDPR is ensured during transfers. According to the Data Protection Committee, the likelihood of access should not be a determining factor in this assessment. 3.2.1. For the facts of the case at hand, this means the following: As established, in the course of sending the newsletter on January 5, 2022, the complainant’s personal data (first and last name, company name, email address) was transferred to Mailchimp.

The central issue in the present proceedings is therefore whether the data was lawfully transferred to the United States, a third country. In this specific case, the respondent relies on the 2010 standard data protection clauses in effect at the time of the data transfer, which would make the transfer lawful in conjunction with additional measures contractually agreed upon with Mailchimp (specifically: European Commission Implementing Decision 2010/87/EU of February 5, 2010, on SCCs for the transfer of personal data to processors in third countries pursuant to Directive 95/46/EC of the European Parliament and of the Council, OJ L 2010/39, p. 5). The modernized standard data protection clauses of June 2021 (Implementing Decision (EU) 2021/914 of the European Commission dated June 4, 2021 – Ref. C(2021) 3972, OJ EU No. L 199/31 of June 7, 2021) are not yet applicable to the specific case because, as admitted by the respondent, they had not yet been introduced by Mailchimp at the time the email in question was sent.

First, as noted, it must be assumed that the respondent agreed with Mailchimp to the 2010 standard data protection clauses as well as supplementary safeguards. However, based on the following considerations, it cannot be assumed that these measures are sufficient to conclude that a level of protection equivalent to that of the GDPR exists in this specific case: As established, Mailchimp qualifies as a provider of electronic communications services under U.S. law and is therefore subject to surveillance by U.S. intelligence agencies. Mailchimp itself refers in its “annual transparency reports” to actual government requests, which thus do occur—albeit in small numbers. Even upon specific request by the Court, the respondent was unable to explain in its statement of May 22, 2025, why, in its view, such access—which, according to the CJEU, does not comply with European data protection standards—could not legally or practically occur.

The complainant rightly points out that Mailchimp, as a U.S. enterprise, is bound by U.S. law—despite the contractual clauses agreed upon with the respondent—which permits access to its data by security authorities in a manner that contradicts the GDPR. This is because U.S. authorities can, on the basis of U.S. law and their sovereign authority, require a U.S. enterprise to disclose data and are not bound by that enterprise’s agreements due to the contractual nature of such agreements (CJEU C-311/18 (Schrems II), para. 132 et seq.), a fact that the respondent was unable to refute. The complainant rightly points out that Mailchimp, as a U.S. enterprise, is bound by U.S. law—despite the contractual clauses agreed upon with the respondent—which permits access to its data by security authorities in a manner that conflicts with the GDPR. This is because U.S. authorities can, on the basis of U.S. law and their sovereign authority, require a U.S. enterprise to disclose data and are not bound by that enterprise’s agreements due to their contractual nature (CJEU C-311/18 (Schrems II), para. 132 et seq.), a fact that the respondent was unable to rebut.

In this context, reference is made to the concerns already cited, expressed by the CJEU in its “Schrems II” judgement, regarding the extensive access rights of U.S. security authorities to the data of European citizens, as well as the lack of legal remedies available to the data subjects. These concerns, which led to the annulment of the “EU-U.S. Privacy Shield,” must also be taken into account when assessing a data transfer pursuant to Article 46(2)(c) of the GDPR, and the respondent was unable to dispel them. In this context, reference is made to the concerns already cited, which were expressed by the CJEU in its “Schrems II” judgement regarding the extensive access that U.S. security authorities have to the data of European citizens, as well as the lack of legal remedies available to those affected. These concerns, which led to the invalidation of the “EU-U.S. Privacy Shield,” must also be taken into account when assessing a data transfer pursuant to article 46(2)(c) of the GDPR, and the respondent has failed to address them.

This also applies to the supplementary safeguards invoked by the respondent. This is because such a supplementary measure can only be considered effective within the meaning of the Court of Justice’s judgement in the “Schrems II” case if and to the extent that it—on its own or in conjunction with other — precisely closes the gaps in legal protection that the data exporter identified when assessing the legal provisions and practices applicable to its transfers in the third country. In this specific case, it is not clear how the publication of transparency reports and the general policy on handling government requests are intended to ensure an adequate level of data protection. Nor can internal directives and employee training prevent Mailchimp from complying with U.S. laws and, if necessary, being required to disclose information. The same applies to encryption technologies and strict access controls: at best, these can prevent hackers from gaining unauthorized access, whereas the data importer has a direct obligation to a U.S. authority authorized under U.S. law to grant access to or disclose the imported data that is in its possession, custody, or under its control.

This obligation may also expressly extend to the cryptographic keys, without which the data is unreadable (EDPB Recommendations 01/2020, para. 81). Finally, it is also unclear to what extent Mailchimp’s obligations to provide information to the respondent in the event of a government request are intended to prevent access, or how the respondent could take “legal” action against a requesting U.S. intelligence agency. Although suspending further data transfers is contractually possible, it would not alter Mailchimp’s obligation to disclose data already transferred to the requesting authority. Furthermore, there is also the possibility that the requesting intelligence agency could prohibit the disclosure of information to the customer (in this case, the respondent) from the outset. This also applies to the supplementary measures cited by the respondent. This is because such a supplementary measure can only be considered effective within the meaning of the Court of Justice’s judgement in the “Schrems II” case if and to the extent that it—on its own or in conjunction with other — precisely closes the gaps in legal protection that the data exporter identified when assessing the legal provisions and practices applicable to its transfers in the third country.

In the present case, it is not apparent to what extent the publication of transparency reports and the general policy on handling government requests are intended to establish an adequate level of data protection. Nor can internal directives and employee training prevent Mailchimp from complying with U.S. laws and, if necessary, having to disclose information. The same applies to encryption technologies and strict access controls: at best, these can prevent hackers from gaining unauthorized access, whereas the data importer has a direct obligation to a U.S. authority authorized under U.S. law to grant access to or disclose the imported data that is in its possession, custody, or under its control. This obligation may also expressly extend to the cryptographic keys, without which the data is unreadable (EDPB Recommendations 01 from 2020, para. 81). Finally, it is also unclear to what extent Mailchimp’s obligations to provide information to the respondent in the event of a government request are intended to prevent access, or how the respondent could take “legal” action against a requesting U.S. intelligence agency.

Although suspending further data transfers is contractually possible, it would not alter Mailchimp’s obligation to disclose data already transferred to the requesting authority. Furthermore, there is also the possibility that the requesting intelligence agency could prohibit the disclosure of information to the customer (in this case, the respondent) from the outset. Since it follows from Article 5(2) (“Accountability of the controller”) in conjunction with para 1(a) (“Lawfulness of data processing”) it follows that, in this specific case, the respondent, as the controller, must also demonstrate the lawfulness of the transfer of the complainant’s personal data to the United States—specifically, compliance with Chapter V of the GDPR—and any insufficient evidence is to her detriment. In this specific case, the respondent was unable to demonstrate that appropriate safeguards within the meaning of Article 46(1) of the GDPR existed that would provide the complainant, as the data subject, with a level of data protectionlevel of data protection, including the possibility of seeking effective legal remedies in the United States.

In this regard, the lack of “sensitivity” of the newsletter in question or the transferred data (according to the respondent, merely publicly available business data) is irrelevant, since the CJEU, in its “Schrems II” judgement, did not base its decision on how “sensitive” the information transferred to the third country is, and Article 44 of the GDPR also does not distinguish based on whether extremely low-risk data is being transferred, for which there is only a very low baseline risk (arg.: “any”). As noted, the EDPB also expressly does not focus on the likelihood of access by foreign authorities. Since it follows from Article 5, paragraph 2 (“Accountability of the controller”) in conjunction with paragraph 1, subparagraph (a) (“Lawfulness of data processing”) it follows that, in the specific case at hand, the respondent, as the controller, must also demonstrate the lawfulness of the transfer of the complainant’s personal data to the United States—specifically, compliance with Chapter V of the GDPR—and the burden of proof lies with the respondent if such proof is insufficient.

In this specific case, the respondent was unable to demonstrate that appropriate safeguards within the meaning of article 46, paragraph 1, GDPR, which would provide the complainant, as the data subject, with a level of data protection in accordance with the GDPR, including the possibility of seeking effective legal remedies in the United States. In this regard, the lack of “sensitivity” of the newsletter in question or the transferred data (according to the respondent, merely publicly available business data) is irrelevant, since the CJEU, in its “Schrems II” judgement, did not base its decision on how “sensitive” the information transferred to the third country is, and article 44 of the GDPR also does not distinguish based on whether extremely low-risk data is being transferred, for which there is only a very low baseline risk (arg.: “any”). As stated, the EDPB also expressly does not base its assessment on the likelihood of access by foreign authorities.

With regard to a possible exception within the meaning of Art. 49 GDPR, no specific argument was presented, and in the Court’s view, no such exception arises from the record.No specific argument was raised regarding a possible exception under Article 49 of the GDPR, and, in the Court’s view, no such exception arises from the record. Consequently, it must be assumed that the respondent, as the controller, violated the principles of Articles 44 et seq. of the GDPR by sending a newsletter to the complainant for direct marketing purposes as part of its enterprise operations using the U.S. email service provider Mailchimp, by failing to ensure that U.S. authorities and/or intelligence agencies could not gain access to the complainant’s personal data in a manner contrary to the GDPR. In particular, the GDPR is violated by the lack of sufficiently precise definitions regarding the scope of government access—which is unnecessary in a democratic state—as well as by the complainant’s inability, as the data subject, to seek an effective legal remedy before an independent Court.

The infringement was therefore to be established as claimed by the complainant.Consequently, it must be concluded that the respondent, as the controller, violated the principles of article 44, ff of the GDPR by failing to ensure that U.S. authorities and/or intelligence agencies could not gain access to the complainant’s personal data in a manner contrary to the GDPR. In particular, the GDPR is violated by the lack of sufficiently precise definitions regarding the scope of government access—which is unnecessary in a democratic state—as well as by the complainant’s lack of opportunity, as a data subject, to seek an effective remedy before an independent Court. The violation of the law was therefore to be formally established as requested by the complainant. No consideration was given to the transfer (also) of the IP address, along with the possibility of identifying further personal data of the complainant (such as location or content interests), as well as the “extensive profiling” of the complainant carried out by Mailchimp, since these new facts were raised only during the proceedings before the Administrative Court (BVwG) and are therefore not covered at all by the data protection complaint to which the complaint regarding failure to act relates.

In this respect, therefore, there can be no inaction on the part of the authority with regard to the issuance of a decision and no transfer of jurisdiction to the BVwG from the outset; the new facts are thus not a matter for the complaint regarding failure to act (see, regarding the general requirements for a complaint for failure to act, Leeb in Hengstschläger/Leeb, AVG § 8 VwGVG (as of Feb. 15, 2017, rdb.at), paras. 3, 5).There was no need to address the issue—raised for the first time in the statement of June 7, 2025—regarding the transfer (also) of the IP address, including the possibility of identifying additional personal data of the complainant (such as location or content-related interests), as well as the “extensive profiling” of his person carried out by Mailchimp, since these new facts were raised only during the proceedings before the Federal Administrative Court (BVwG) and are therefore not covered at all by the data protection complaint to which the complaint regarding inaction relates.