E-Mail dated 27/06/2018 to the Council’s data protection unit:
the Council has lately begun to use Cloudflare. Being a TOR user, browsing to the Council’s website (https://www.consilium.europa.eu/ ) results in a captcha request by Cloudflare, embedding Google.com (e.g. when I use exit node 184.108.40.206).
By using Cloudflare the Council is violating the GDPR directive for several reasons:
a) The transfer of personal data (i.e. user IP address) to Cloudflare and Google is not necessary for operating the website. This is simply demonstrated by the European Parliament’s website which does not rely on such services.
b) The transfer of personal data (i.e. user IP address) to Cloudflare and Google is possibly a transfer of data to servers outside the EU located in third countries which do not satisfy the conditions established by the GDPR.
I therefore request you to cease using Cloudflare. Please answer my complaint within one month.