Moderate
Court ruling
Decided
Ireland · Jan 29, 2025
EU General Court rules Irish DPC acted unlawfully for refusing to investigate noyb complaint
The EU General Court held that the Irish Data Protection Commission unlawfully refused to investigate a complaint filed by noyb. The court dismissed the DPC's claims against the European Data Protection Board. The case can now be appealed…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Published
European Union · Jan 28, 2025
Only 1.3% of GDPR cases before EU DPAs result in a fine, analysis shows
A noyb analysis of EDPB statistics finds that, on average, just 1.3% of cases before national data protection authorities end in a fine. Between 2018 and 2023 EU DPAs imposed €4.29 billion in fines, with almost 40% stemming from noyb…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Executive order
Signed
United States (federal) · Jan 23, 2025
Trump signs executive order that could dismantle EU-US Transatlantic Data Privacy Framework
The US President signed an executive order stating that all Biden-era national security decisions, including those underpinning the EU‑US data transfer framework, will be reviewed and possibly revoked within 45 days. The Transatlantic Data…
European Commission · EU-U.S. Data Privacy Framework
Moderate
Enforcement
Filed
European Union · Jan 16, 2025
noyb files GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi over transfers to China
noyb has lodged six GDPR complaints in five EU countries alleging unlawful transfers of Europeans' personal data to China by TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi. The complaints request that DPAs suspend the transfers under…
European Commission · Standard Contractual Clauses
Moderate
Court ruling
Decided
Austria · Jan 9, 2025
CJEU rules Austrian DPA cannot limit data subject complaints to two per month
The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
Italy · Dec 19, 2024
noyb files GDPR complaint against Ryanair over mandatory biometric face scans
noyb has filed a complaint with the Italian Data Protection Authority alleging that Ryanair forces new customers to create permanent accounts and undergo a biometric facial‑recognition verification to book flights. The complaint says this…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
Moderate
Fine
Decided
Netherlands · Dec 18, 2024
Dutch DPA fines Netflix €4.75 million for inadequate data‑subject information
The Dutch Data Protection Authority issued a decision imposing a €4.75 million fine on Netflix for not adequately informing customers about its data processing. The authority found Netflix failed to provide clear information and a full…
Dutch Data Protection Authority (Autoriteit Persoonsgegevens) · General Data Protection Regulation
Moderate
Enforcement
Decided
European Union · Dec 13, 2024
EDPS finds European Commission illegally used political micro‑targeting
The European Data Protection Supervisor issued a decision that the European Commission illegally targeted ads using sensitive political data. The EDPS issued only a reprimand, noting no fine was needed as the practice stopped. The decision…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Enforcement
Filed
France · Dec 12, 2024
noyb files complaint against BeReal for forced consent dark pattern in France
noyb has lodged a complaint with the French data protection authority (CNIL) alleging that BeReal uses a dark‑pattern consent banner that forces users to accept tracking for advertising. The complaint argues the consent is not freely…
CNIL · General Data Protection Regulation
Moderate
Interpretation
In effect
European Union · Dec 2, 2024 · effective Dec 2, 2024
noyb qualified as EU 'Qualified Entity' to bring collective GDPR redress actions
noyb has been approved as a Qualified Entity under Directive (EU) 2020/1828, allowing it to bring collective injunctions and redress actions across the EU. Approvals were issued by Austria's Bundeskartellamt on 2 December 2024 and…
Bundeskartellamt; Irish Ministry for Justice · General Data Protection Regulation
Low
Court ruling
Decided
Germany · Nov 19, 2024
German Federal Court rules loss of control over personal data is compensable under GDPR
The Bundesgerichtshof held that the mere loss of control over one's personal data can constitute damage under the GDPR. The court said this damage is compensable when it results from a GDPR violation, without needing additional negative…
EDPB · General Data Protection Regulation
Low
Enforcement
Pending
Ireland · Nov 12, 2024
Meta proposes "less personalized" ads that use location and age without consent, sparking GDPR enforcement concerns
Meta announced a new ad option that will still use personal data such as location and date of birth without obtaining consent, which noyb says violates the GDPR. The organization has filed pending litigation against Meta for this and…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Filed
France · Oct 22, 2024
noyb files complaint against Pinterest for unlawful tracking without consent
noyb lodged a complaint with the French data protection authority (CNIL) alleging that Pinterest tracks EU users for personalised advertising without obtaining opt‑in consent. The complaint cites a CJEU ruling that legitimate interest…
CNIL · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Oct 4, 2024
CJEU rules Meta must minimise use of personal data for ads
The Court of Justice of the European Union (CJEU) held that Meta must limit the processing of personal data for online advertising to what is strictly necessary, applying the GDPR data‑minimisation principle regardless of consent. It also…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Sep 25, 2024
noyb files complaint against Mozilla over default ‘Privacy Preserving Attribution’ feature in Firefox
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Mozilla enabled a ‘Privacy Preserving Attribution’ feature in Firefox by default without informing users or obtaining consent. The feature allows Firefox to…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
In effect
Belgium · Sep 12, 2024
Belgian DPA orders Mediahuis news sites to add reject button to cookie banners, imposes daily penalty
The Belgian Data Protection Authority ordered four Mediahuis news sites to add a “reject” button on the first layer of their cookie banners and to change misleading button colours. Non‑compliance triggers a penalty of €50,000 per day per…
Belgian Data Protection Authority · General Data Protection Regulation
Moderate
Data protection authority action
Filed
Austria · Aug 29, 2024
noyb files complaint with Austrian DPA over automated credit checks by KSV1870 and Unsere Wasserkraft
noyb lodged a complaint with the Austrian Data Protection Authority against credit reference agency KSV1870 and energy supplier Unsere Wasserkraft. The complaint alleges that customers are subjected to fully automated credit checks that…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 22, 2024
noyb files two complaints with EDPS over EU Parliament recruitment platform data breach
In early May 2024 the European Parliament disclosed a massive breach of its PEOPLE recruitment platform affecting over 8,000 staff. noyb filed two complaints with the European Data Protection Supervisor alleging violations of the EU GDPR…
European Data Protection Supervisor · General Data Protection Regulation
Low
Enforcement
Filed
Greece · Aug 13, 2024
Greek supermarket Alfa Vita faces GDPR complaint over incomplete data access
noyb filed a complaint with the Greek Data Protection Authority alleging that Alfa Vita's loyalty‑card program fails to provide full data‑subject access, omitting personal data and recipient information. The complaint cites a Court of…
Greek Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 12, 2024
noyb files nine GDPR complaints against X over AI training of 60 million EU users
noyb has lodged GDPR complaints in Austria, Belgium, France, Greece, Ireland, Italy, the Netherlands, Spain and Poland alleging that X used personal data of over 60 million EU/EEA users to train its AI system without consent. The Irish…
Irish Data Protection Commission · General Data Protection Regulation
