Moderate
Enforcement
Filed
European Union · Jan 22, 2021
noyb files complaint against European Parliament over US data transfers and deceptive cookie banners
noyb filed a complaint with the European Data Protection Supervisor on behalf of six MEPs alleging illegal transfers of personal data to US providers Google and Stripe and misleading cookie banners on the Parliament's COVID‑19 testing…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 29, 2020
Vienna Superior Court orders Facebook to pay €500 and grant full data access
The Viennese Superior Court ruled that Facebook must pay Mr. Schrems €500 in emotional damages and provide him full access to all personal data the company holds about him. The court held that Facebook does not need user consent under GDPR…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
Malta · Nov 12, 2020
noyb files complaint with Maltese DPA over C-Planet voter data breach
noyb filed a complaint with the Maltese Data Protection Authority against C-Planet IT Solutions for leaking personal data of 337,384 voters, including phone numbers, dates of birth and political opinions. NGOs Daphne Foundation and…
Maltese Data Protection Authority · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Oct 29, 2020
noyb reaches 3,000 subscribers for GDPRtoday newsletter
The organization noyb announced that its GDPRtoday newsletter has surpassed 3,000 subscribers within ten months. The newsletter provides English summaries of GDPR decisions from across Europe and has translated and summarized over 500…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Oct 21, 2020
noyb files GDPR complaint against Wizz Air over charged rectification request
On 21.10.2020 noyb filed a GDPR complaint with the Austrian Data Protection Authority against Wizz Air for charging €35 to update a passenger's surname. The airline required the passenger to call a paid hotline to make the change…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Oct 12, 2020
Irish High Court grants judicial review to stop Facebook EU-US data transfers
The Irish High Court granted leave for a judicial review filed by privacy group noyb against the Irish Data Protection Commission (DPC) to compel a decision on Facebook's EU‑US data transfers. The action seeks to enforce the European Court…
Irish Data Protection Commission · Standard Contractual Clauses
Moderate
Enforcement
Announced
European Union · Sep 25, 2020
noyb reports companies' limited responses to GDPR data‑transfer inquiries after Schrems II
The non‑profit noyb contacted 33 firms in mid‑2020 asking for details on their international data transfers under Articles 12‑15 of the GDPR, following the CJEU Schrems II ruling. Many companies either did not reply or gave only generic…
European Commission · Standard Contractual Clauses
Moderate
Enforcement
Filed
European Union · Sep 22, 2020
noyb files 101 complaints against EU website operators for illegal US data transfers
noyb lodged 101 complaints against EU/EEA website operators using Google Analytics and Facebook Connect, alleging illegal transfers of personal data to the US. The complaints rely on the CJEU judgment of 16 July 2020 that such transfers…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Announced
Ireland · Sep 14, 2020
Irish High Court grants Facebook leave to file Judicial Review, stays DPC EU‑US data‑flow investigation
The Irish High Court granted Facebook leave to bring a Judicial Review (Case No 2020/617 JR) and ordered a stay of the Data Protection Commission's ex officio investigation into Facebook's EU‑US data transfers. The DPC may resume the…
Data Protection Commission (DPC) · Standard Contractual Clauses
Moderate
Enforcement
Filed
European Union · Aug 17, 2020
101 GDPR complaints filed against EU companies for US data transfers to Google and Facebook
Noyb has filed 101 complaints in all 30 EU and EEA member states alleging that European companies continue to forward visitor data to Google and Facebook in the US. The complaints cite the CJEU ruling that the EU‑US Privacy Shield is…
Data Protection Authorities · Standard Contractual Clauses
Moderate
Enforcement
Filed
Austria · Aug 4, 2020
noyb files GDPR complaint against CRIF over arbitrary credit score
noyb.eu lodged a GDPR complaint with the Austrian Data Protection Authority against credit rating agency CRIF for assigning a credit score of 446 despite claiming no personal data was stored. The score caused an electricity supplier to…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Guidance
Published
European Union · Jul 20, 2020
noyb releases guidance for EU companies on Schrems II data‑transfer obligations
The guidance explains steps EU controllers should take after the CJEU Schrems II judgment, including reviewing data flows, stopping transfers that rely on the invalidated Privacy Shield, and notifying DPAs when using SCCs after a negative…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jul 16, 2020
CJEU invalidates EU‑US Privacy Shield and bars use of SCCs for Facebook
The Court of Justice of the European Union ruled that the EU‑US Privacy Shield is invalid because US surveillance laws conflict with EU fundamental rights. It also held that Standard Contractual Clauses cannot be used by Facebook and…
European Commission · Standard Contractual Clauses
Moderate
Court ruling
Decided
European Union · Jul 12, 2020
CJEU judgment limits EU‑US data outsourcing, confirms 'necessary' transfers exempt
The Court of Justice of the EU ruled that "necessary" transfers of personal data to the US are not affected by the case, while voluntary outsourcing of processing to US providers may violate the GDPR. The judgment confirms the invalidity…
European Commission · Standard Contractual Clauses
Moderate
Court ruling
Decided
Ireland · Jul 6, 2020
Irish High Court grants leave for judicial review of DPC's slow GDPR complaint procedure
The Irish High Court granted leave to noyb.eu to challenge the Data Protection Commission's handling of GDPR complaints against WhatsApp and Instagram. The DPC has taken two years to produce a first draft inquiry report, the first step of…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jun 30, 2020
Vienna Regional Court issues limited judgment in Schrems v. Facebook case
The Vienna Regional Court delivered a written judgment that largely summarised the facts and granted the plaintiff full access to his data and €500 symbolic damages. The judge limited legal analysis of GDPR compliance to 19 sentences and…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Jun 24, 2020
EDPB responds to noyb open letter on Facebook case procedural concerns
The European Data Protection Board acknowledged the issues raised by noyb regarding the Irish DPA's handling of the Facebook case and said it is working to improve consistency procedures and cooperation among supervisory authorities. No…
European Data Protection Board · General Data Protection Regulation
Moderate
Fine
In effect
France · Jun 19, 2020
French court upholds €50 million CNIL fine against Google
The French Data Protection Authority (CNIL) imposed a €50 million fine on Google for insufficient information and lack of valid consent for personalized ads. The Conseil d’État confirmed the CNIL's decision and affirmed its jurisdiction…
CNIL · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · May 13, 2020
noyb files GDPR complaint against Google over Android Advertising ID tracking
noyb filed a formal GDPR complaint against Google for tracking users via the Android Advertising ID without a valid legal basis. The complaint was submitted on behalf of an Austrian citizen to the Austrian Data Protection Authority. GDPR…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Guidance
Published
European Union · Apr 9, 2020
noyb releases ad‑hoc guidance on GDPR compliance for COVID‑19 data processing
noyb published an ad‑hoc paper outlining how the GDPR permits processing personal data to combat the coronavirus pandemic. The paper cites Articles 6(1)(d) and 9(2)(i) as legal bases and stresses the need for privacy‑by‑design, data…
EDPB · General Data Protection Regulation
