Moderate
Court ruling
Decided
Germany · Jul 4, 2023
CJEU rules Meta must rely on consent for advertising, limiting GDPR bypass attempts
The Court of Justice of the EU held that Meta may only process personal data for core services and must obtain freely given consent for advertising and data sharing. The judgment rejects Meta's reliance on contractual necessity and…
EDPB · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Jul 4, 2023
EU Commission proposes GDPR Procedures Regulation that may limit citizens' procedural rights
The European Commission has issued a proposal to create a GDPR Procedures Regulation to address cooperation gaps among DPAs. Critics say the draft strips citizens of procedural rights and gives companies extensive participation rights. The…
European Commission · General Data Protection Regulation
Moderate
Fine
In effect
Sweden · Jul 3, 2023
Swedish DPA fines Tele2 €1M and CDON €0.3M for illegal use of Google Analytics
The Swedish Data Protection Authority (IMY) issued decisions against four companies for unlawful EU‑US data transfers via Google Analytics. It imposed a fine of 12 mio SEK (≈€1 M) on Tele2 and 300 000 SEK on CDON. The authority also…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Amendment
Passed
Ireland · Jun 28, 2023
Ireland passes amendment to Data Protection Act allowing DPC to declare GDPR cases confidential
The Irish government has passed an amendment to the Data Protection Act, creating Section 26A which permits the Data Protection Commission to declare documents relating to pending GDPR procedures confidential and criminalise their…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Moderate
Amendment
Proposed
Ireland · Jun 26, 2023
Irish Parliament debates amendment to criminalise reporting on DPC procedures
A last‑minute amendment (Section 26A) was added to the Courts and Civil Law (Miscellaneous Provisions) Bill 2022 that would allow the Irish Data Protection Commissioner to declare its procedures confidential and make reporting on them a…
Irish Data Protection Commissioner · General Data Protection Regulation
Moderate
Amendment
Pending
Ireland · Jun 26, 2023
Irish government adds Section 26A to Data Protection Act, criminalising reporting on DPC procedures
A last‑minute amendment (Section 26A) was inserted into the Courts and Civil Law (Miscellaneous Provisions) Bill 2022, allowing the Irish Data Protection Commissioner to declare most of its procedures confidential. The amendment would make…
Irish Data Protection Commissioner (DPC) · General Data Protection Regulation
Moderate
Enforcement
Filed
Belgium · Jun 23, 2023
noyb files complaint against TeleSign for unlawful profiling of mobile users
noyb filed a complaint with the Belgian Data Protection Authority alleging that TeleSign receives phone data from BICS and creates reputation scores without consent, violating the GDPR. The complaint cites the use of AI-generated trust…
Belgian Data Protection Authority · General Data Protection Regulation
Moderate
Fine
In effect
France · Jun 22, 2023
French CNIL fines Criteo €40 million for GDPR violations
The French Data Protection Authority (CNIL) fined Criteo €40 million for violating the GDPR, including lack of valid consent, transparency, and failure to respect the right to erasure and access. The enforcement followed complaints filed…
CNIL · General Data Protection Regulation
Moderate
Fine
In effect
Sweden · Jun 13, 2023
Swedish Data Protection Authority fines Spotify €5 million for GDPR access violations
The Swedish Data Protection Authority (IMY) imposed a fine of 58 million Swedish crowns (≈ €5 million) on Spotify for not fully complying with users' right of access under the GDPR. The authority ordered Spotify to provide the complete set…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · May 23, 2023
EU Commission proposes GDPR Procedures Regulation to address enforcement delays
Noyb calls for an EU procedural regulation to fix widespread delays and procedural tricks in GDPR enforcement across member states. The European Commission has indicated interest in such a regulation and also in the upcoming EU Collective…
European Commission · General Data Protection Regulation
Moderate
Fine
Announced
Ireland · May 22, 2023
Irish DPC imposes €1.2 billion fine on Meta for EU‑US data transfers
The Irish Data Protection Commission, backed by the European Data Protection Board, ordered Meta to cease all transfers of European personal data to the United States and to return data already transferred to EU data centres. The decision…
Irish Data Protection Commission · Standard Contractual Clauses
Moderate
Data protection authority action
Announced
Malta · May 17, 2023
Maltese DPA orders C-PLANET to disclose data source within 20 days or face fine
The Maltese Data Protection Authority (IDPC) ordered IT company C-PLANET to provide details on the source of personal data collected on voters within 20 days. Failure to comply will result in a proportionate and dissuasive fine under the…
Maltese Data Protection Authority (IDPC) · General Data Protection Regulation
Moderate
Data protection authority action
Decided
Austria · May 10, 2023
Austrian DPA deems Clearview AI’s biometric data processing illegal, orders deletion, no fine
The Austrian Data Protection Authority ruled that Clearview AI may not process the complainant’s biometric data and must delete the data. The decision cites GDPR violations for scraping and selling personal data of Europeans. No monetary…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · May 4, 2023
CJEU rules GDPR right of access must include documents and database extracts
The Court of Justice of the European Union held that a data subject’s right of access under Article 15 GDPR includes providing the data in context, such as relevant documents and database extracts. The ruling arose from a complaint against…
EDPB · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Apr 4, 2023
noyb launches free tool for broad Facebook opt‑out under GDPR
The privacy NGO noyb released an online tool that lets users submit a broad objection to Meta’s processing of personal data for targeted advertising, which Meta bases on “legitimate interest”. The tool simplifies the GDPR right to object…
EDPB · General Data Protection Regulation
Moderate
Data protection authority action
Decided
Austria · Mar 27, 2023
Austrian DPA rules CRIF's processing of Austrian citizens' personal data illegal
The Austrian Data Protection Authority found that CRIF GmbH illegally processed addresses, dates of birth, names and other personal data of millions of Austrians obtained from AZ Direkt without consent or legal basis, ordering the deletion…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Mar 17, 2023
Austrian Federal Administrative Court allows mobile providers to refuse access requests for location data without proof of exclusive use
The Austrian Federal Administrative Court (BVwG) ruled that A1 Telekom Austria may deny a data subject's request for traffic and location data unless the subject can prove exclusive use of the phone. The court deemed location data…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Feb 28, 2023
noyb files complaints against data brokers for refusing cookie‑based authentication of GDPR access requests
noyb lodged a series of complaints against websites and data brokers that denied or complicated GDPR access requests by requiring additional identification beyond cookies. The complaints argue that, under GDPR and EDPB guidance, users…
EDPB · General Data Protection Regulation
Moderate
Fine
Announced
Ireland · Jan 27, 2023
Irish DPC announces €390 million fine on Meta for GDPR consent breach
The Irish Data Protection Commission announced a €390 million fine against Meta, ordering it to obtain valid consent for personalized advertising after the European Data Protection Board issued a binding decision. The fine illustrates…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Guidance
Published
European Union · Jan 24, 2023
EDPB releases draft report on minimum requirements for cookie consent banners
The European Data Protection Board's task force issued a draft report outlining unlawful cookie banner practices under EU law. It sets a minimum threshold for consent banners, including the need for a visible reject option and prohibition…
European Data Protection Board (EDPB) · General Data Protection Regulation
