Low
Enforcement
Decided
Austria · Oct 20, 2022
Austrian DSB orders Profil.at to fix forced cookie banners after GDPR complaint
noyb filed a GDPR complaint against Profil.at for using a forced two‑step cookie consent mechanism. The Austrian Data Protection Authority issued a decision on 10 August 2023, confirming the violations and giving the site an eight‑week…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Published
European Union · Oct 13, 2022
CJEU Advocate General opinion may limit GDPR non‑material damages compensation
The Advocate General of the Court of Justice of the EU issued an opinion that could restrict the right to claim non‑material damages under the GDPR. The opinion questions whether Article 82 allows damages without material loss and suggests…
EDPB · General Data Protection Regulation
Moderate
Executive order
Signed
United States (federal) · Oct 7, 2022
US President Biden signs Executive Order on surveillance, unlikely to satisfy EU law
President Joe Biden signed a new Executive Order intended to address EU concerns over US surveillance practices. The order retains bulk surveillance and creates a non‑judicial “Data Protection Review Court,” which the source says does not…
EDPB · General Data Protection Regulation
Low
Proposed regulation
Announced
European Union · Sep 25, 2022
EU-US data transfer agreement in principle remains unimplemented six months later
On 25 March 2022 US President Joe Biden and European Commission President Ursula von der Leyen announced an "agreement in principle" on EU‑US data transfers, but six months later no concrete framework has been published. The CJEU has…
European Commission · General Data Protection Regulation
Low
Enforcement
Filed
France · Aug 24, 2022
noyb files complaint with CNIL over Gmail's unsolicited advertising emails
noyb.eu lodged a complaint with the French Data Protection Authority (CNIL) alleging that Google’s Gmail sends unsolicited advertising emails without user consent, contrary to the ePrivacy Directive and a CJEU ruling. The complaint cites…
CNIL · ePrivacy Directive
Moderate
Enforcement
Filed
European Union · Aug 9, 2022
226 GDPR complaints lodged against deceptive OneTrust cookie banners
noyb filed 226 complaints with 18 data protection authorities over websites using OneTrust cookie banners that employ deceptive designs. The complaints allege violations of GDPR requirements for a fair yes/no consent choice. Some websites…
EDPB · General Data Protection Regulation
Moderate
Fine
Decided
European Union · Jul 21, 2022
6.3 million Euro fine imposed on Grindr for GDPR violations
noyb’s complaints resulted in a 6.3 million Euro fine against the gay dating app Grindr for breaching the GDPR. The fine was highlighted in noyb’s 2021 Annual Report.
EDPB · General Data Protection Regulation
High
Fine
In effect
Greece · Jul 13, 2022
Greek DPA fines Clearview AI €20 million and bans biometric processing
The Greek Data Protection Authority imposed a €20 million fine on Clearview AI and prohibited the company from processing biometric data of individuals in Greece. Clearview must delete all existing facial‑recognition data of Greek citizens…
Greek Data Protection Authority · General Data Protection Regulation
Moderate
Data protection authority action
Published
Ireland · Jul 7, 2022
Irish DPC issues Draft Decision on Facebook EU-US data transfers, starts one-month comment period
The Irish Data Protection Commission issued a Draft Decision under Article 60 GDPR concerning Meta's Facebook EU‑US data transfers. The draft triggers a one‑month comment period for other European DPAs and does not immediately halt the…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
In effect
European Union · Jul 5, 2022
EU DPAs ban use of Google Analytics over unlawful US data transfers
The Italian Data Protection Authority (GPDP) declared Google Analytics illegal because it transfers personal data to the United States. French CNIL and Austrian DPA issued similar orders, requiring websites to stop using the service. The…
Italian Data Protection Authority (GPDP) · General Data Protection Regulation
Low
Appeal
Filed
Sweden · Jun 22, 2022
noyb files appeal against Swedish DPA's refusal to treat data subjects as parties in GDPR complaints
The Swedish Data Protection Authority (IMY) rejected a request by a data subject to participate in a GDPR access‑request procedure, stating the subject was not a party to the case. noyb filed an appeal to the administrative court in…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Low
Appeal
Filed
Spain · Jun 21, 2022
noyb files appeal against Spanish DPA decision restricting access to location data
noyb filed an appeal to the Audiencia Nacional challenging the Spanish DPA's decision that denied a customer access to his location data held by Virgin Telco. The DPA had sided with the telecom operator, limiting the GDPR right of access.…
Agencia Española de Protección de Datos (AEPD) · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · May 24, 2022
noyb warns of widespread GDPR non‑compliance and lack of enforcement after four years
The NGO noyb states that despite the GDPR becoming applicable on 25 May 2018, many companies continue to ignore users' rights and enforcement remains weak. It notes that about 50 cross‑country cases it filed have not yet received a final…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · May 22, 2022
Open Letter warns EU‑US data transfer deal lacks material US law changes
The open letter published on 2022‑05‑22 criticises the announced Trans‑Atlantic Data Privacy Framework for relying on US executive orders without substantive changes to US surveillance law. It argues that the framework repeats the…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
Austria · May 2, 2022
Austrian DPA rejects risk‑based approach for EU‑US data transfers, deems Google IP anonymisation insufficient
The Austrian Data Protection Authority issued a decision stating that the GDPR does not permit a risk‑based approach for transfers to insecure third countries such as the United States. It also concluded that Google’s IP anonymisation does…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Malta · Apr 29, 2022
noyb files second complaint against C‑Planet for refusing data‑subject access to source of political data
noyb filed a second complaint with Malta's Information & Data Protection Commissioner (IDPC) demanding C‑Planet disclose the original source of illegally processed voter data. The company previously received a €65,000 fine for illegal…
Information & Data Protection Commissioner (IDPC) · General Data Protection Regulation
Moderate
Settlement
Settled
Ireland · Apr 28, 2022 · effective Apr 28, 2022
Irish DPC to pay tens of thousands in costs to noyb over 47‑month delay in WhatsApp and Instagram GDPR cases
The Irish Data Protection Commission settled with privacy group noyb, agreeing to cover tens of thousands of euros in legal costs after a 47‑month delay in drafting decisions on WhatsApp and Instagram cases. The delay contravenes GDPR…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Moderate
Data protection authority action
In effect
France · Apr 5, 2022
CNIL rules use of Google Analytics illegal and orders French sites to comply with GDPR
The French data protection authority (CNIL) decided that using Google Analytics violates the GDPR and ordered three French website controllers to bring their practices into compliance. The decision follows earlier Austrian DPA rulings and…
CNIL · General Data Protection Regulation
Low
Proposed regulation
Announced
European Union · Mar 25, 2022
EU and US announce 'agreement in principle' for new data sharing system (Privacy Shield 2.0)
Commission President Ursula von der Leyen and President Biden announced an "agreement in principle" for a new EU‑US data sharing framework. No legal text exists yet; the announcement is purely political and will require months to draft and…
European Commission · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Mar 14, 2022
Amazon workers file GDPR access requests to demand data transparency
Warehouse workers from Germany, UK, Italy, Poland and Slovakia filed data subject access requests under Article 15 GDPR to learn how Amazon processes their personal data. Amazon has one month to respond and disclose the processing…
EDPB · General Data Protection Regulation
