Low
Appeal
Appealed
Pennsylvania · Sep 23, 2026
EPIC files amicus brief urging Third Circuit to uphold Pennsylvania’s Internet Sharing Ban on voter data
EPIC submitted an amicus brief in the Third Circuit case Voter Reference Foundation v. Schmidt, asking the court to maintain Pennsylvania’s rule that bars posting voter registration lists online. The brief describes the rule, called the…
Internet Sharing Ban
Moderate
Lawsuit filed
Filed
United States (federal) · Sep 8, 2026
EFF releases 1,000 pages of CMS records on AI-driven Medicare WISeR prior‑authorization program
EFF obtained about 1,000 pages of CMS documents through its FOIA lawsuit filed in March, revealing delays, denials, and financial incentives in the WISeR AI model. The records show requests sometimes waited up to 83 days and vendors denied…
Centers for Medicare & Medicaid Services (CMS)
Low
Court ruling
Decided
United States (federal) · Aug 4, 2026
Ninth Circuit rules Perplexity AI’s Comet browser not liable under CFAA
The Ninth Circuit Court of Appeals held that Perplexity AI’s Comet browser does not violate the Computer Fraud and Abuse Act because the tool itself does not access Amazon’s servers; users do. The court rejected Amazon’s claim that…
Computer Fraud and Abuse Act
Moderate
Lawsuit filed
Filed
European Union · Jan 28, 2026
noyb debunks 5 GDPR misconceptions on Data Protection Day
The article clarifies that the GDPR does not mandate cookie banners, that DPAs rarely impose fines, and that companies must obtain explicit consent for tracking. It also explains the limited scope of the right of access and counters claims…
EDPB · General Data Protection Regulation
Low
Lawsuit filed
Filed
Germany · Jan 28, 2026
noyb files lawsuit against Hamburg DPA over Pay or Okay case involving SPIEGEL
In 2024, privacy advocacy group noyb sued the Hamburg Data Protection Authority concerning a Pay or Okay implementation dispute with the German news magazine SPIEGEL. The case highlights concerns about DPA impartiality and enforcement…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 18, 2025 · deadline Dec 31, 2025
Austrian Supreme Court orders Meta to give users full data access within 14 days
The Austrian Supreme Court ruled that Meta must provide a complete copy of all personal data to any user request within 14 days, including source, recipient and purpose information. The court also required Meta to obtain explicit opt‑in…
EDPB · General Data Protection Regulation
Low
Appeal
Filed
Sweden · Aug 12, 2024
noyb appeals to Swedish court over IMY's refusal to investigate data subject complaints
noyb has filed an appeal with the Kammarrätten i Stockholm challenging the Swedish Data Protection Authority's practice of forwarding complaints without investigation. The appeal follows a Supreme Administrative Court ruling that…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Dec 7, 2023
CJEU rules automated credit scoring violates GDPR and expands judicial review of DPAs
The Court of Justice of the European Union issued two judgments: one confirming national courts can fully review DPA decisions, and another finding that automatically calculated credit scores breach Article 22 GDPR. The rulings require…
EDPB · General Data Protection Regulation
Low
Court ruling
Decided
Austria · Oct 9, 2023
Austrian court orders streaming service DAZN to comply with GDPR access request after 5 years
The Austrian Federal Administrative Court ruled on 6 September 2023 that DAZN must provide the missing information requested under the GDPR right of access. DAZN complied with the court order on 13 September 2023, completing the request…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · May 4, 2023
CJEU rules GDPR right of access must include documents and database extracts
The Court of Justice of the European Union held that a data subject’s right of access under Article 15 GDPR includes providing the data in context, such as relevant documents and database extracts. The ruling arose from a complaint against…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Mar 17, 2023
Austrian Federal Administrative Court allows mobile providers to refuse access requests for location data without proof of exclusive use
The Austrian Federal Administrative Court (BVwG) ruled that A1 Telekom Austria may deny a data subject's request for traffic and location data unless the subject can prove exclusive use of the phone. The court deemed location data…
EDPB · General Data Protection Regulation
Low
Court ruling
Decided
Spain · Jan 25, 2023
Spanish Audiencia Nacional rules location data is personal data, overturning AEPD decision
The Audiencia Nacional annulled the Spanish DPA's earlier ruling that denied a customer access to his location data held by Virgin telco. The court held that location data qualifies as personal data under the GDPR, obliging the provider to…
Agencia Española de Protección de Datos (AEPD) · General Data Protection Regulation
Low
Court ruling
Decided
Sweden · Nov 9, 2022
Swedish court rules IMY must investigate GDPR complaints and grant complainants party status
The Stockholm administrative court held that a complainant under Article 77 GDPR can request a decision from the Swedish Data Protection Authority (IMY) after six months and that Swedish law does not deny party status. The court ordered…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Low
Appeal
Filed
Sweden · Jun 22, 2022
noyb files appeal against Swedish DPA's refusal to treat data subjects as parties in GDPR complaints
The Swedish Data Protection Authority (IMY) rejected a request by a data subject to participate in a GDPR access‑request procedure, stating the subject was not a party to the case. noyb filed an appeal to the administrative court in…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Low
Appeal
Filed
Spain · Jun 21, 2022
noyb files appeal against Spanish DPA decision restricting access to location data
noyb filed an appeal to the Audiencia Nacional challenging the Spanish DPA's decision that denied a customer access to his location data held by Virgin Telco. The DPA had sided with the telecom operator, limiting the GDPR right of access.…
Agencia Española de Protección de Datos (AEPD) · General Data Protection Regulation
Low
Appeal
Filed
Austria · Nov 15, 2021
noyb appeals Austrian DPA decision on cell‑phone location and traffic data to Federal Administrative Court
noyb filed a notice of appeal with Austria's Federal Administrative Court against the DSB's decision that A1 may refuse to provide location and traffic data to a user. The DSB argued the data are not personal because a third party could…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jul 20, 2021
Austrian Supreme Court refers Facebook case to CJEU over consent vs contract and awards €500 symbolic damages
The Austrian Supreme Court (OGH) referred four questions to the Court of Justice of the EU concerning Facebook's reliance on contract instead of consent under the GDPR. In a partial judgment, the court awarded Max Schrems €500 for lack of…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Luxembourg · Jan 25, 2021
Luxembourg administrative tribunal rules CNPD must handle GDPR complaints against US controllers
The Luxembourg administrative tribunal found that the CNPD wrongly dismissed complaints against US‑based data controllers Apollo and RocketReach and ordered the DPA to reopen the cases. The decision follows earlier appeals by privacy NGO…
Commission Nationale pour la Protection des Données (CNPD) · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 29, 2020
Vienna Superior Court orders Facebook to pay €500 and grant full data access
The Viennese Superior Court ruled that Facebook must pay Mr. Schrems €500 in emotional damages and provide him full access to all personal data the company holds about him. The court held that Facebook does not need user consent under GDPR…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Jul 6, 2020
Irish High Court grants leave for judicial review of DPC's slow GDPR complaint procedure
The Irish High Court granted leave to noyb.eu to challenge the Data Protection Commission's handling of GDPR complaints against WhatsApp and Instagram. The DPC has taken two years to produce a first draft inquiry report, the first step of…
Irish Data Protection Commission · General Data Protection Regulation
