Moderate
Guidance
Published
Spain · Jul 21, 2026
AEPD publishes technical guidance on data accuracy and minimisation in AI processing
The Spanish Data Protection Agency (AEPD) released a technical note interpreting the GDPR accuracy and data‑minimisation principles for AI‑driven personal data processing. It provides criteria for controllers, processors and DPOs to assess…
Agencia Española de Protección de Datos · RGPD
Moderate
Guidance
Announced
European Union · Jul 17, 2026
EDPB calls for legal basis for cross‑regulatory information sharing
The European Data Protection Board urged the European Commission to create a clear legal basis for regulators to share information across competences. It highlighted the need for stronger legislation to enable confidential information…
European Data Protection Board · General Data Protection Regulation
Moderate
Court ruling
Decided
United States (federal) · Jun 29, 2026
US Supreme Court decision undermines EU‑US Data Privacy Framework
The US Supreme Court ruled in Trump v. Slaughter that the FTC cannot be an independent agency. The decision calls into question the independence requirement for the EU‑US Data Privacy Framework, effectively collapsing the adequacy…
EDPB · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Dec 10, 2025
EU‑US data transfers face imminent risk as US legal changes could undermine TAFPF and SCCs
The blog notes that most EU‑US transfers rely on the Transatlantic Data Privacy Framework (TAFPF) or Standard Contract Clauses (SCCs), which depend on fragile US laws and executive orders. It warns that upcoming US Supreme Court decisions…
EDPB · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · May 20, 2025
EU trilogue negotiations on GDPR procedural regulation risk undermining enforcement
The European Commission's draft procedural regulation aimed at harmonising GDPR enforcement is in its final trilogue meeting. The proposal introduces long deadlines and complex steps that could delay cases until around 2029. NGOs warn the…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Apr 17, 2025
EU's draft GDPR Procedural Regulation faces criticism for increasing complexity
The European Commission has introduced a draft GDPR Procedural Regulation to improve cross‑border DPA cooperation. The proposal is currently in trilogue negotiations with the European Parliament and the Council. Critics argue the draft…
European Commission · General Data Protection Regulation
Moderate
Guidance
Published
United States (federal) · Mar 31, 2025
2024 HMDA Modified LAR Data Now Available on FFIEC Platform
The Home Mortgage Disclosure Act (HMDA) Modified Loan Application Register data for 2024 have been released on the FFIEC HMDA Platform for about 4,898 filers. The loan‑level data are modified to protect consumer privacy and are now…
Consumer Financial Protection Bureau · Home Mortgage Disclosure Act
Moderate
Executive order
Signed
United States (federal) · Jan 23, 2025
Trump signs executive order that could dismantle EU-US Transatlantic Data Privacy Framework
The US President signed an executive order stating that all Biden-era national security decisions, including those underpinning the EU‑US data transfer framework, will be reviewed and possibly revoked within 45 days. The Transatlantic Data…
European Commission · EU-U.S. Data Privacy Framework
Moderate
Court ruling
Decided
Austria · Jan 9, 2025
CJEU rules Austrian DPA cannot limit data subject complaints to two per month
The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Proposed regulation
Published
European Union · Jul 16, 2024
EU Parliament and Council publish amendments to GDPR procedural regulation draft
The European Parliament and the Council of the EU have released their amended versions of the Commission's draft GDPR procedural regulation. The amendments aim to harmonise procedural cooperation among DPAs across member states. The next…
European Commission · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Jul 4, 2023
EU Commission proposes GDPR Procedures Regulation that may limit citizens' procedural rights
The European Commission has issued a proposal to create a GDPR Procedures Regulation to address cooperation gaps among DPAs. Critics say the draft strips citizens of procedural rights and gives companies extensive participation rights. The…
European Commission · General Data Protection Regulation
Moderate
Amendment
Pending
Ireland · Jun 26, 2023
Irish government adds Section 26A to Data Protection Act, criminalising reporting on DPC procedures
A last‑minute amendment (Section 26A) was inserted into the Courts and Civil Law (Miscellaneous Provisions) Bill 2022, allowing the Irish Data Protection Commissioner to declare most of its procedures confidential. The amendment would make…
Irish Data Protection Commissioner (DPC) · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · May 23, 2023
EU Commission proposes GDPR Procedures Regulation to address enforcement delays
Noyb calls for an EU procedural regulation to fix widespread delays and procedural tricks in GDPR enforcement across member states. The European Commission has indicated interest in such a regulation and also in the upcoming EU Collective…
European Commission · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · May 24, 2022
noyb warns of widespread GDPR non‑compliance and lack of enforcement after four years
The NGO noyb states that despite the GDPR becoming applicable on 25 May 2018, many companies continue to ignore users' rights and enforcement remains weak. It notes that about 50 cross‑country cases it filed have not yet received a final…
EDPB · General Data Protection Regulation
Moderate
Data protection authority action
In effect
France · Apr 5, 2022
CNIL rules use of Google Analytics illegal and orders French sites to comply with GDPR
The French data protection authority (CNIL) decided that using Google Analytics violates the GDPR and ordered three French website controllers to bring their practices into compliance. The decision follows earlier Austrian DPA rulings and…
CNIL · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jun 24, 2021
European Court of Justice invalidated Privacy Shield in July 2020
The European Court of Justice ruled that the EU‑US Privacy Shield framework is invalid, affecting cross‑border data transfers. The decision was highlighted in noyb’s 2020 Annual Report.
Privacy Shield
Moderate
Enforcement
Filed
European Union · May 26, 2021 · effective May 25, 2018
Digital Rights alliance files legal complaints across Europe against facial recognition company Clearview AI
Noyb and other EU digital‑rights groups submitted complaints to data‑protection authorities in France, Austria, Italy, Greece and the United Kingdom to halt Clearview AI's mass facial‑recognition surveillance. The regulators have three…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Oct 12, 2020
Irish High Court grants judicial review to stop Facebook EU-US data transfers
The Irish High Court granted leave for a judicial review filed by privacy group noyb against the Irish Data Protection Commission (DPC) to compel a decision on Facebook's EU‑US data transfers. The action seeks to enforce the European Court…
Irish Data Protection Commission · Standard Contractual Clauses
Moderate
Court ruling
Announced
Ireland · Sep 14, 2020
Irish High Court grants Facebook leave to file Judicial Review, stays DPC EU‑US data‑flow investigation
The Irish High Court granted Facebook leave to bring a Judicial Review (Case No 2020/617 JR) and ordered a stay of the Data Protection Commission's ex officio investigation into Facebook's EU‑US data transfers. The DPC may resume the…
Data Protection Commission (DPC) · Standard Contractual Clauses
Moderate
Court ruling
Decided
European Union · Jul 12, 2020
CJEU judgment limits EU‑US data outsourcing, confirms 'necessary' transfers exempt
The Court of Justice of the EU ruled that "necessary" transfers of personal data to the US are not affected by the case, while voluntary outsourcing of processing to US providers may violate the GDPR. The judgment confirms the invalidity…
European Commission · Standard Contractual Clauses
