Moderate
Data protection authority action
Decided
Ireland · Jul 16, 2025
DPC issues final decision reprimanding Children’s Health Ireland for GDPR security breaches
The Irish Data Protection Commission concluded that Children’s Health Ireland (CHI) at Tallaght University Hospital breached GDPR security and confidentiality obligations. CHI was reprimanded and ordered to bring its processing into…
Data Protection Commission (Ireland) · General Data Protection Regulation
Moderate
Executive order
Signed
United States (federal) · Jan 23, 2025
Trump signs executive order that could dismantle EU-US Transatlantic Data Privacy Framework
The US President signed an executive order stating that all Biden-era national security decisions, including those underpinning the EU‑US data transfer framework, will be reviewed and possibly revoked within 45 days. The Transatlantic Data…
European Commission · EU-U.S. Data Privacy Framework
Moderate
Enforcement
Filed
European Union · Jan 16, 2025
noyb files GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi over transfers to China
noyb has lodged six GDPR complaints in five EU countries alleging unlawful transfers of Europeans' personal data to China by TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi. The complaints request that DPAs suspend the transfers under…
European Commission · Standard Contractual Clauses
Moderate
Enforcement
Filed
European Union · Aug 22, 2024
noyb files two complaints with EDPS over EU Parliament recruitment platform data breach
In early May 2024 the European Parliament disclosed a massive breach of its PEOPLE recruitment platform affecting over 8,000 staff. noyb filed two complaints with the European Data Protection Supervisor alleging violations of the EU GDPR…
European Data Protection Supervisor · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jan 28, 2024
Survey finds 74% of insiders say authorities would find GDPR violations in average EU company
A noyb survey of over 1,000 data‑protection professionals reports that 74% believe authorities would discover relevant GDPR violations during on‑site inspections. Respondents cite lack of clear DPA decisions, fines, and public enforcement…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Nov 16, 2023
noyb files complaint with EDPS over EU Commission’s political micro‑targeting ads on X
noyb lodged a complaint with the European Data Protection Supervisor alleging the EU Commission used unlawful micro‑targeting on X to promote its chat‑control proposal. The ads targeted users based on political views and religious beliefs…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Proposed regulation
Announced
European Union · Jul 10, 2023
EU Commission adopts third Trans-Atlantic Data Privacy Framework, likely to face CJEU challenge
The European Commission has introduced a new Trans-Atlantic Data Privacy Framework as its third attempt to secure an EU‑US data transfer adequacy decision. Privacy‑rights group noyb says it will challenge the decision before the Court of…
European Commission · EU-U.S. Data Privacy Framework
Moderate
Fine
In effect
Sweden · Jul 3, 2023
Swedish DPA fines Tele2 €1M and CDON €0.3M for illegal use of Google Analytics
The Swedish Data Protection Authority (IMY) issued decisions against four companies for unlawful EU‑US data transfers via Google Analytics. It imposed a fine of 12 mio SEK (≈€1 M) on Tele2 and 300 000 SEK on CDON. The authority also…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Fine
Announced
Ireland · May 22, 2023
Irish DPC imposes €1.2 billion fine on Meta for EU‑US data transfers
The Irish Data Protection Commission, backed by the European Data Protection Board, ordered Meta to cease all transfers of European personal data to the United States and to return data already transferred to EU data centres. The decision…
Irish Data Protection Commission · Standard Contractual Clauses
Moderate
Executive order
Signed
United States (federal) · Oct 7, 2022
US President Biden signs Executive Order on surveillance, unlikely to satisfy EU law
President Joe Biden signed a new Executive Order intended to address EU concerns over US surveillance practices. The order retains bulk surveillance and creates a non‑judicial “Data Protection Review Court,” which the source says does not…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · May 24, 2022
noyb warns of widespread GDPR non‑compliance and lack of enforcement after four years
The NGO noyb states that despite the GDPR becoming applicable on 25 May 2018, many companies continue to ignore users' rights and enforcement remains weak. It notes that about 50 cross‑country cases it filed have not yet received a final…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · May 22, 2022
Open Letter warns EU‑US data transfer deal lacks material US law changes
The open letter published on 2022‑05‑22 criticises the announced Trans‑Atlantic Data Privacy Framework for relying on US executive orders without substantive changes to US surveillance law. It argues that the framework repeats the…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
Austria · May 2, 2022
Austrian DPA rejects risk‑based approach for EU‑US data transfers, deems Google IP anonymisation insufficient
The Austrian Data Protection Authority issued a decision stating that the GDPR does not permit a risk‑based approach for transfers to insecure third countries such as the United States. It also concluded that Google’s IP anonymisation does…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Fine
In effect
Malta · Jan 20, 2022
Malta data protection commissioner fines C-Planet €65,000 for illegal voter data collection
The Malta Information & Data Protection Commissioner (IDPC) imposed a €65,000 fine on IT company C-Planet for unlawfully collecting personal data of 98% of Maltese voters, including political preferences. The IDPC found the processing…
Information & Data Protection Commissioner (IDPC) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · May 26, 2021 · effective May 25, 2018
Digital Rights alliance files legal complaints across Europe against facial recognition company Clearview AI
Noyb and other EU digital‑rights groups submitted complaints to data‑protection authorities in France, Austria, Italy, Greece and the United Kingdom to halt Clearview AI's mass facial‑recognition surveillance. The regulators have three…
EDPB · General Data Protection Regulation
Moderate
Guidance
Published
European Union · Jan 27, 2021
noyb urges stronger GDPR enforcement on European Data Protection Day
noyb highlights that despite the GDPR's strong provisions, compliance remains low and enforcement insufficient. The organization calls on data protection authorities and companies to move from paper rights to real protection, citing the…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
Malta · Nov 12, 2020
noyb files complaint with Maltese DPA over C-Planet voter data breach
noyb filed a complaint with the Maltese Data Protection Authority against C-Planet IT Solutions for leaking personal data of 337,384 voters, including phone numbers, dates of birth and political opinions. NGOs Daphne Foundation and…
Maltese Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Oct 12, 2020
Irish High Court grants judicial review to stop Facebook EU-US data transfers
The Irish High Court granted leave for a judicial review filed by privacy group noyb against the Irish Data Protection Commission (DPC) to compel a decision on Facebook's EU‑US data transfers. The action seeks to enforce the European Court…
Irish Data Protection Commission · Standard Contractual Clauses
Moderate
Court ruling
Announced
Ireland · Sep 14, 2020
Irish High Court grants Facebook leave to file Judicial Review, stays DPC EU‑US data‑flow investigation
The Irish High Court granted Facebook leave to bring a Judicial Review (Case No 2020/617 JR) and ordered a stay of the Data Protection Commission's ex officio investigation into Facebook's EU‑US data transfers. The DPC may resume the…
Data Protection Commission (DPC) · Standard Contractual Clauses
Moderate
Enforcement
Filed
European Union · Aug 17, 2020
101 GDPR complaints filed against EU companies for US data transfers to Google and Facebook
Noyb has filed 101 complaints in all 30 EU and EEA member states alleging that European companies continue to forward visitor data to Google and Facebook in the US. The complaints cite the CJEU ruling that the EU‑US Privacy Shield is…
Data Protection Authorities · Standard Contractual Clauses
