High
Fine
In effect
Italy · Mar 10, 2022
Italian DPA fines Clearview AI €20 million and bans biometric processing
The Italian data protection authority imposed a €20 million fine on Clearview AI and prohibited the company from processing biometric data of individuals in Italy. Clearview must delete all existing biometric data of Italian citizens and…
Italian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Mar 4, 2022
noyb launches second wave of GDPR complaints against deceptive cookie banners
noyb sent 270 draft complaints to website operators whose cookie banners violate the GDPR, offering a 60‑day grace period before filing formal complaints. If companies do not fully comply, noyb will file complaints with DPAs, which may…
Data Protection Authorities · General Data Protection Regulation
Low
Enforcement
Filed
DE-HE · Feb 25, 2022
noyb files complaint against giropay for processing detailed purchase data
The German payment service giropay stores item‑by‑item purchase information from online shops, including health‑related and sexual‑preference data. noyb lodged a complaint with the Hessian State Commissioner for Data Protection, alleging…
Hessian State Commissioner for Data Protection and Freedom of Information · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Jan 23, 2022
noyb reports low GDPR enforcement rates on Data Protection Day
noyb disclosed that only 15% of its 51 GDPR complaints were decided within a year and no pan‑European case has been resolved under the one‑stop‑shop mechanism. The organization highlights delays across DPAs, including a three‑year‑plus…
EDPB · General Data Protection Regulation
Moderate
Fine
In effect
Malta · Jan 20, 2022
Malta data protection commissioner fines C-Planet €65,000 for illegal voter data collection
The Malta Information & Data Protection Commissioner (IDPC) imposed a €65,000 fine on IT company C-Planet for unlawfully collecting personal data of 98% of Maltese voters, including political preferences. The IDPC found the processing…
Information & Data Protection Commissioner (IDPC) · General Data Protection Regulation
Low
Enforcement
Published
Austria · Jan 13, 2022
Austrian DSB rules EU‑US transfers to Google Analytics illegal under GDPR
The Austrian Data Protection Authority (DSB) decided that the continuous use of Google Analytics violates the GDPR following the Schrems II ruling. The DSB rejected Google's claimed technical and organisational measures as ineffective…
Austrian Data Protection Authority (Datenschutzbehörde) · California Delete Act
Moderate
Enforcement
Published
European Union · Jan 11, 2022
EDPS reprimands European Parliament for illegal EU‑US data transfers via Google and Stripe
The European Data Protection Supervisor (EDPS) issued a decision reprimanding the European Parliament for violating data protection law on its COVID‑testing website. The use of Google Analytics and Stripe was found to breach the CJEU's…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Enforcement
Filed
Luxembourg · Dec 22, 2021
noyb files complaint with Luxembourg CNPD over Amazon's automated e-recruiting decisions
noyb lodged a complaint with the Luxembourg data protection authority (CNPD) against Amazon for using automated decision‑making in its Mechanical Turk recruitment process. The complainant was denied access without explanation, and Amazon…
Commission Nationale pour la Protection des Données (CNPD) · General Data Protection Regulation
Low
Enforcement
Filed
DE-RP · Dec 22, 2021
noyb files GDPR complaint against Airbnb over automated review deletions
noyb filed a GDPR complaint with the Data Protection Authority of Rheinland‑Pfalz against Airbnb for automatically deleting a host's five‑star review. The complaint alleges violations of Article 22(3) GDPR, which requires the right to…
Data Protection Authority of Rheinland-Pfalz · General Data Protection Regulation
Low
Enforcement
Pending
Ireland · Dec 19, 2021
Facebook ignores EU Court rulings on data transfers, Irish DPC enforcement pending
noyb reports that Facebook's 86‑page Transfer Impact Assessment disregards the CJEU Schrems I and II rulings that require EU‑US data transfers to stop. The Irish Data Protection Commission has not yet issued a decision despite a complaint…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
In effect
Norway (EEA) · Dec 15, 2021 · effective Dec 15, 2021
Norwegian DPA fines Grindr €6.3 M for illegal sharing of sensitive data
The Norwegian Data Protection Authority imposed a fine of 65 Mio NOK on Grindr for sharing sensitive personal data without valid consent. The authority found the consent mechanism invalid and highlighted the lack of a genuine opt‑out. The…
Norwegian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · Dec 12, 2021
Irish DPC sends threat letters to noyb over Facebook ROPA publication
noyb published Facebook's four‑page Record of Processing Activities (ROPA) required by Article 30 GDPR. The Irish Data Protection Commission, which received the ROPA on 27.9.2018, sent angry letters to noyb demanding the removal of the…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Announced
Germany · Dec 10, 2021
noyb and ZDF Magazin Royale seek data donors to enforce GDPR micro‑targeting ban
noyb and ZDF Magazin Royale are asking users of the "Who Targets Me" browser extension from the 2021 German federal election to donate their data. The aim is to find a case to enforce the GDPR prohibition on political micro‑targeting under…
EDPB · General Data Protection Regulation
Moderate
Guidance
Published
Ireland · Dec 4, 2021
Irish DPC tried to embed Facebook consent bypass into EDPB Guidelines, but final 2019 guidelines omitted it
A letter shows the Irish DPC held ten meetings with Facebook and agreed on a GDPR bypass by moving consent into terms and conditions. The DPC then drafted EDPB guideline language to allow this approach, but other DPAs criticised it…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Low
Enforcement
Announced
Austria · Nov 28, 2021
Austrian DPA rejects Facebook's confidentiality claim in GDPR data‑transfer dispute
The Austrian Data Protection Authority (DSB) rejected Facebook's claim that certain documents were confidential, providing all documents to the Irish DPC. The DSB also reminded Facebook that official Austrian procedures must be conducted…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
In effect
Ireland · Nov 23, 2021 · effective Nov 18, 2021
Irish DPC removes noyb from GDPR procedure after demanding NDA
The Irish Data Protection Commission (DPC) demanded that privacy activist group noyb sign a non‑disclosure agreement to continue hearing its complaint against Facebook. After noyb refused, the DPC removed the organization from the GDPR…
Irish Data Protection Commission · General Data Protection Regulation
Low
Appeal
Filed
Austria · Nov 15, 2021
noyb appeals Austrian DPA decision on cell‑phone location and traffic data to Federal Administrative Court
noyb filed a notice of appeal with Austria's Federal Administrative Court against the DSB's decision that A1 may refuse to provide location and traffic data to a user. The DSB argued the data are not personal because a third party could…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Nov 11, 2021
noyb files GDPR complaint against Grindr over selfie ID requirement
noyb lodged a GDPR complaint with the Austrian Data Protection Authority alleging that Grindr's policy of requiring a selfie with a passport and email paper violates data minimisation and the right of access. The complainant was denied…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Luxembourg · Oct 21, 2021
noyb files GDPR complaint against Amazon Europe over opaque automated payment decisions
noyb lodged a complaint with Luxembourg's data protection authority alleging that Amazon Europe's automated "Monthly Invoice" payment rejections violate GDPR transparency and access requirements. The complaint cites the lack of explanation…
Luxembourg National Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Oct 18, 2021
noyb files GDPR complaint against Acxiom and CRIF Bürgel over illegal credit scores
noyb lodged a complaint in Germany alleging that address trader Acxiom and credit reference agency CRIF Bürgel illegally use personal data to calculate credit scores without consent, violating the GDPR and the German Federal Data…
EDPB · General Data Protection Regulation
