Gmail now order processing – and how you can use Gmail GDPR-compliant

On February 5th, 2020 the Higher Administrative Court of Münster issued a court ruling that the Gmail service offered by Google is not a telecommunications service. The decision (Az. 13 A 17/16) was justified as follows: In order to act as a telecommunications service i. S. v. To apply Section 3 No. 24 TKG, Gmail would have to transmit signals entirely or predominantly. Although Google operates its own network infrastructure in Germany. However, this would primarily be used for YouTube and the search engine and not for the transmission of signals. When sending and receiving e-mails, Google’s activity is limited to assigning the IP addresses of the end devices to the e-mail addresses, breaking down messages into data packets and feeding them into the open Internet or receiving them from there and forwarding them to the recipients .

The Federal Network Agency was therefore obliged to remove Gmail as a telecommunications service from the public directory. This resolves the long-term dispute that began in 2012 between the Federal Network Agency and Google. The federal network agency wanted to oblige Google to register Gmail as a telecommunications service. Google, on the other hand, sued the Cologne Administrative Court, was unsuccessful and appealed to the Higher Administrative Court, which submitted the question to the ECJ. The ECJ did not regard Gmail as a telecommunications service in its judgment issued on June 13, 2019 (Az. C-193/18). The OVG Münster agreed with its judgment of February 5th, 2020.

It follows from the judgment that Gmail is to be regarded as order processing and that a data processing agreement must be concluded in order to use Gmail in accordance with the GDPR. Google makes the corresponding contractual clauses available as part of the paid product G Suite. If you want to use Gmail in a GDPR-compliant manner, you should make sure that you check and accept the current version of the relevant contractual clauses, otherwise you run the risk of not using Gmail in a GDPR-compliant manner and there is a risk that you will be fined becomes. To find out which Google contractual clauses are up to date and how you can check and accept them, follow this link.

If you want to make sure that your systems really do meet all the requirements of the GDPR, we can help you check your systems for GDPR compliance. To do this, follow this link to our offer.