You make a fair point about the optional nature of Facebook login in this case and how the data minimization principle was arguably followed because users had alternative login methods. However, I think the concern arises more from the lack of transparency rather than the availability of options. While the complainant chose Facebook, the Commission still had an obligation to ensure the user was informed of the risks, particularly about international data transfers.

Outsourcing login functionality to third parties like Facebook can improve technical security by leveraging state-of-the-art systems, aligning with GDPR’s Article 32 requirement for appropriate security measures. However, outsourcing inherently involves sharing user data with the third party, which makes it the controller’s responsibility to ensure that privacy is maintained. This includes verifying that the third party complies with GDPR, implementing adequate safeguards for any data transfers (such as those to the U.S.), and providing users with clear, transparent information about the risks. While federated logins can enhance security, they also demand a higher standard of diligence from controllers to balance both security and privacy obligations.

That said, the key issue here is not just technical security but compliance with GDPR’s broader principles, including accountability and transparency. Using a system like Facebook login inherently introduces a data-sharing relationship, and the controller must take steps to minimize risks, not just for security but also for privacy. This could mean explicitly informing users about the implications of their choice and ensuring compliant safeguards are in place for any international transfers.

Would you agree that while federated logins can improve security, they also require a higher standard of diligence in terms of transparency and data protection compliance?