Moderate
Data protection authority action
In effect
France · Apr 5, 2022
CNIL rules use of Google Analytics illegal and orders French sites to comply with GDPR
The French data protection authority (CNIL) decided that using Google Analytics violates the GDPR and ordered three French website controllers to bring their practices into compliance. The decision follows earlier Austrian DPA rulings and…
CNIL · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Mar 14, 2022
Amazon workers file GDPR access requests to demand data transparency
Warehouse workers from Germany, UK, Italy, Poland and Slovakia filed data subject access requests under Article 15 GDPR to learn how Amazon processes their personal data. Amazon has one month to respond and disclose the processing…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Mar 4, 2022
noyb launches second wave of GDPR complaints against deceptive cookie banners
noyb sent 270 draft complaints to website operators whose cookie banners violate the GDPR, offering a 60‑day grace period before filing formal complaints. If companies do not fully comply, noyb will file complaints with DPAs, which may…
Data Protection Authorities · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Jan 23, 2022
noyb reports low GDPR enforcement rates on Data Protection Day
noyb disclosed that only 15% of its 51 GDPR complaints were decided within a year and no pan‑European case has been resolved under the one‑stop‑shop mechanism. The organization highlights delays across DPAs, including a three‑year‑plus…
EDPB · General Data Protection Regulation
Moderate
Fine
In effect
Malta · Jan 20, 2022
Malta data protection commissioner fines C-Planet €65,000 for illegal voter data collection
The Malta Information & Data Protection Commissioner (IDPC) imposed a €65,000 fine on IT company C-Planet for unlawfully collecting personal data of 98% of Maltese voters, including political preferences. The IDPC found the processing…
Information & Data Protection Commissioner (IDPC) · General Data Protection Regulation
Moderate
Enforcement
Published
European Union · Jan 11, 2022
EDPS reprimands European Parliament for illegal EU‑US data transfers via Google and Stripe
The European Data Protection Supervisor (EDPS) issued a decision reprimanding the European Parliament for violating data protection law on its COVID‑testing website. The use of Google Analytics and Stripe was found to breach the CJEU's…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Fine
In effect
Norway (EEA) · Dec 15, 2021 · effective Dec 15, 2021
Norwegian DPA fines Grindr €6.3 M for illegal sharing of sensitive data
The Norwegian Data Protection Authority imposed a fine of 65 Mio NOK on Grindr for sharing sensitive personal data without valid consent. The authority found the consent mechanism invalid and highlighted the lack of a genuine opt‑out. The…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Announced
Ireland · Oct 15, 2021
Irish DPC orders noyb to remove draft decision from website
The Irish Data Protection Commission sent a take‑down request to privacy activist group noyb on 14 Oct 2021, ordering removal of a draft decision that allegedly strips Facebook users of GDPR rights. noyb refused, citing Austrian law and…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
Announced
Ireland · Sep 2, 2021
Irish DPC issues €225 million fine against WhatsApp
The Irish Data Protection Commission imposed a €225 million fine on WhatsApp (owned by Facebook) under the GDPR. The fine was increased from an initial €50 million after pressure from other EU data protection authorities. Max Schrems of…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 13, 2021
noyb files complaints against cookie paywalls of seven German and Austrian news sites over unlawful consent
noyb filed complaints against the cookie paywalls of SPIEGEL.de, Zeit.de, heise.de, FAZ.net, derStandard.at, krone.at and t-online.de, arguing that the "pay or okay" model violates the GDPR's requirement for freely given consent. The…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 10, 2021
noyb files 422 GDPR complaints over deceptive cookie banners
noyb filed 422 formal GDPR complaints with data protection authorities in ten EU countries concerning dark‑pattern cookie banners. After a warning phase, 42% of identified violations were remedied, but 82% of the 516 sites still breach the…
Data Protection Authorities · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jul 19, 2021
noyb reports 2.5‑year delay in GDPR access‑request complaints against streaming services
In January 2019 noyb filed complaints against eight streaming services for failing to comply with the GDPR right of access. After two and a half years only one complaint was resolved after noyb took the responsible authority to court. The…
EDPB · General Data Protection Regulation
Moderate
Settlement
Settled
European Union · Jul 16, 2021
Max Schrems notes settlement with Irish DPC in Jan 2021 amid Schrems II fallout
The statement highlights that of the 101 model complaints filed by noyb after the Schrems II ruling, none have been decided yet. It notes that the original Facebook complaint led to a settlement with the Irish Data Protection Commission in…
Irish Data Protection Commission · Standard Contractual Clauses
Moderate
Enforcement
Announced
European Union · May 31, 2021
noyb launches automated system, sends 500 draft GDPR cookie‑banner complaints across Europe
noyb sent more than 500 draft GDPR complaints to companies using unlawful cookie banners, offering a one‑month grace period before filing formal complaints. The NGO developed software to detect violations and generate complaints…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · May 26, 2021 · effective May 25, 2018
Digital Rights alliance files legal complaints across Europe against facial recognition company Clearview AI
Noyb and other EU digital‑rights groups submitted complaints to data‑protection authorities in France, Austria, Italy, Greece and the United Kingdom to halt Clearview AI's mass facial‑recognition surveillance. The regulators have three…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
Germany · Jan 28, 2021 · deadline Feb 12, 2021
Hamburg DPA preliminarily deems Clearview AI’s biometric profiling of EU residents illegal and orders partial deletion
The Hamburg Data Protection Authority preliminarily found that Clearview AI’s collection of biometric profiles of Europeans violates the GDPR and ordered the deletion of the mathematical hash values of the complainant’s biometric profile.…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Fine
In effect
Norway (EEA) · Jan 26, 2021
Norwegian DPA fines Grindr €9.63 million for illegal sharing of sensitive data
The Norwegian Data Protection Authority imposed a fine of 100 Mio NOK on Grindr for sharing personal and sensitive data without valid consent. The authority found Grindr's consent mechanism invalid and highlighted the company's lack of…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jan 22, 2021
noyb files complaint against European Parliament over US data transfers and deceptive cookie banners
noyb filed a complaint with the European Data Protection Supervisor on behalf of six MEPs alleging illegal transfers of personal data to US providers Google and Stripe and misleading cookie banners on the Parliament's COVID‑19 testing…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Enforcement
Filed
Malta · Nov 12, 2020
noyb files complaint with Maltese DPA over C-Planet voter data breach
noyb filed a complaint with the Maltese Data Protection Authority against C-Planet IT Solutions for leaking personal data of 337,384 voters, including phone numbers, dates of birth and political opinions. NGOs Daphne Foundation and…
Maltese Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Oct 21, 2020
noyb files GDPR complaint against Wizz Air over charged rectification request
On 21.10.2020 noyb filed a GDPR complaint with the Austrian Data Protection Authority against Wizz Air for charging €35 to update a passenger's surname. The airline required the passenger to call a paid hotline to make the change…
Austrian Data Protection Authority · General Data Protection Regulation
