High
Guidance
Published
France · Oct 16, 2026 · effective Oct 16, 2026
CNIL guidance on lawful reconstitution of professional email addresses
The CNIL explains that reconstructing professional email addresses from publicly available data must comply with the GDPR and can rely on legitimate interest only if specific conditions are met. Organizations must assess the visibility of…
CNIL · RGPD
High
Fine
Decided
Norway (EEA) · Oct 16, 2026
Norwegian DPA fines Xandr €8.6M for unlawful processing of Grindr users' data
The Norwegian Data Protection Authority issued a final decision on 2 October 2026 imposing an administrative fine of EUR 8.6 million on Xandr Inc. for processing personal and special category data of Grindr users without valid consent.…
Norwegian Data Protection Authority · General Data Protection Regulation
High
Fine
In effect
Italy · Oct 12, 2026 · effective Jun 5, 2026
Italian DPA fines Wind Tre €16.7 million for unlawful telemarketing
The Italian Data Protection Authority imposed an administrative fine of EUR 16 700 000 on Wind Tre S.p.A. for violations of GDPR principles in its telemarketing and contract activation practices. The authority also issued a definitive ban…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
High
Fine
In effect
Italy · Oct 9, 2026 · effective Jul 3, 2026
Italian DPA fines BBVA €5.508 million for ignoring customer’s objection to direct marketing
The Italian Data Protection Authority issued a final decision on 3 July 2026 finding BBVA infringed Articles 5, 12, 21 and 24 of the GDPR by failing to honor a customer's objection to direct marketing. BBVA was ordered to pay an…
Italian Data Protection Authority · General Data Protection Regulation
High
Amendment
Signed
Delaware · Sep 3, 2026 · effective Jan 1, 2027
Delaware Governor signs HB 380, amending the DPDPA effective Jan 1 2027
Governor Meyer signed HB 380 on September 2, amending the Delaware Personal Data Privacy Act. The amendment expands the definition of sensitive data, lowers applicability thresholds, adds new contractual and due‑diligence requirements for…
CFPB · Fair Credit Reporting Act
High
Fine
In effect
European Union · Jul 29, 2024
European data protection authorities fined Meta, Spotify, Criteo and others in 2023 for GDPR violations
In 2023, the Irish DPC ordered Meta to pay €390 million and later €1.2 billion, the Swedish DPA fined Spotify €58 million SEK, and the French CNIL fined Criteo €40 million for breaches of consent and data‑subject rights under EU law.
EDPB · General Data Protection Regulation
High
Penalty
Published
European Union · Aug 23, 2023
EU data protection board draft decision imposes €390 million fine on Meta for forced consent
In December 2022, the European Data Protection Board (EDPB) published a draft decision in the “forced consent” case against Meta, finding the company's practices violated the GDPR. The decision resulted in a €390 million fine. The case…
European Data Protection Board · General Data Protection Regulation
High
Data protection authority action
Filed
Spain · Jul 27, 2023
noyb files complaint with Spanish DPA over Ryanair’s facial‑recognition verification for travel‑agent bookings
noyb lodged a complaint with Spain's Data Protection Authority (AEPD) alleging that Ryanair forces customers who book via online travel agents to undergo a facial‑recognition verification process. The complaint argues that Ryanair lacks a…
Spanish Data Protection Authority (AEPD) · General Data Protection Regulation
High
Guidance
Published
European Union · Jul 24, 2020 · effective Jul 16, 2020
noyb provides step-by-step guide for EU users to stop US data transfers after Schrems II
The document outlines how data subjects can exercise GDPR rights to learn about and halt transfers of their personal data to the United States following the CJEU Schrems II judgment. It provides sample request letters for information…
European Commission · Standard Contractual Clauses
