Moderate
Enforcement
Announced
Ireland · Oct 15, 2021
Irish DPC orders noyb to remove draft decision from website
The Irish Data Protection Commission sent a take‑down request to privacy activist group noyb on 14 Oct 2021, ordering removal of a draft decision that allegedly strips Facebook users of GDPR rights. noyb refused, citing Austrian law and…
Irish Data Protection Commission · General Data Protection Regulation
Low
Guidance
Published
European Union · Sep 2, 2021
noyb hires GDPR lawyers and full stack developers
noyb announced job openings for GDPR lawyers and full stack developers. The announcement invites referrals and directs interested candidates to the job page. It seeks to expand the team to handle its workload.
EDPB · General Data Protection Regulation
Moderate
Fine
Announced
Ireland · Sep 2, 2021
Irish DPC issues €225 million fine against WhatsApp
The Irish Data Protection Commission imposed a €225 million fine on WhatsApp (owned by Facebook) under the GDPR. The fine was increased from an initial €50 million after pressure from other EU data protection authorities. Max Schrems of…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 13, 2021
noyb files complaints against cookie paywalls of seven German and Austrian news sites over unlawful consent
noyb filed complaints against the cookie paywalls of SPIEGEL.de, Zeit.de, heise.de, FAZ.net, derStandard.at, krone.at and t-online.de, arguing that the "pay or okay" model violates the GDPR's requirement for freely given consent. The…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 10, 2021
noyb files 422 GDPR complaints over deceptive cookie banners
noyb filed 422 formal GDPR complaints with data protection authorities in ten EU countries concerning dark‑pattern cookie banners. After a warning phase, 42% of identified violations were remedied, but 82% of the 516 sites still breach the…
Data Protection Authorities · General Data Protection Regulation
Low
Enforcement
Decided
Austria · Aug 4, 2021
Austrian DPA orders credit agency CRIF to disclose scoring logic after GDPR complaint
The Austrian Data Protection Authority ruled that CRIF's credit assessment constitutes profiling under the GDPR and must disclose that the creditworthiness score was calculated only from address, gender, name and date of birth. CRIF must…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jul 20, 2021
Austrian Supreme Court refers Facebook case to CJEU over consent vs contract and awards €500 symbolic damages
The Austrian Supreme Court (OGH) referred four questions to the Court of Justice of the EU concerning Facebook's reliance on contract instead of consent under the GDPR. In a partial judgment, the court awarded Max Schrems €500 for lack of…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jul 19, 2021
noyb reports 2.5‑year delay in GDPR access‑request complaints against streaming services
In January 2019 noyb filed complaints against eight streaming services for failing to comply with the GDPR right of access. After two and a half years only one complaint was resolved after noyb took the responsible authority to court. The…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jul 16, 2021
Anniversary of the CJEU 'Schrems II' decision on EU‑US data transfers
Max Schrems marks one year since the CJEU's Schrems II ruling that declared EU‑US data transfers unlawful. He notes a lack of clear guidance, pending model complaints filed by noyb, and ongoing uncertainty around Standard Contractual…
European Data Protection Board · General Data Protection Regulation
Moderate
Settlement
Settled
European Union · Jul 16, 2021
Max Schrems notes settlement with Irish DPC in Jan 2021 amid Schrems II fallout
The statement highlights that of the 101 model complaints filed by noyb after the Schrems II ruling, none have been decided yet. It notes that the original Facebook complaint led to a settlement with the Irish Data Protection Commission in…
Irish Data Protection Commission · Standard Contractual Clauses
Moderate
Court ruling
Decided
European Union · Jun 24, 2021
European Court of Justice invalidated Privacy Shield in July 2020
The European Court of Justice ruled that the EU‑US Privacy Shield framework is invalid, affecting cross‑border data transfers. The decision was highlighted in noyb’s 2020 Annual Report.
Privacy Shield
Moderate
Proposed regulation
Published
European Union · Jun 14, 2021
noyb and CSL propose Advanced Data Protection Control browser signal to replace cookie banners
noyb and the Sustainable Computing Lab released a technical proposal for an "Advanced Data Protection Control" (ADPC) browser signal. The signal would allow browsers to automatically convey user consent or opt‑in preferences to websites…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · May 31, 2021
noyb launches automated system, sends 500 draft GDPR cookie‑banner complaints across Europe
noyb sent more than 500 draft GDPR complaints to companies using unlawful cookie banners, offering a one‑month grace period before filing formal complaints. The NGO developed software to detect violations and generate complaints…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · May 26, 2021 · effective May 25, 2018
Digital Rights alliance files legal complaints across Europe against facial recognition company Clearview AI
Noyb and other EU digital‑rights groups submitted complaints to data‑protection authorities in France, Austria, Italy, Greece and the United Kingdom to halt Clearview AI's mass facial‑recognition surveillance. The regulators have three…
EDPB · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · May 21, 2021
European Parliament urges Commission to launch infringement proceedings against Ireland over GDPR enforcement
The European Parliament adopted a resolution calling on the European Commission to start infringement procedures against Ireland due to delays by the Irish Data Protection Commission in handling GDPR complaints. The resolution noted that…
European Commission · General Data Protection Regulation
Low
Court ruling
Decided
Ireland · May 13, 2021
Irish High Court orders DPC to halt Facebook EU‑US data transfers
The Irish High Court ruled that the Irish Data Protection Commission must implement the CJEU judgment and stop Facebook's transfers of personal data from the EU to the United States. The court dismissed all reliefs sought by Facebook…
Irish Data Protection Commission · Schrems II judgment
Low
Enforcement
Announced
Austria · May 5, 2021
Austrian DPA may fine Google up to €6 billion for illegal EU‑US data transfers
The Austrian Data Protection Authority (DSB) has the option under the GDPR to impose a fine of up to €6 billion (4% of global turnover) on Google for continuing to transfer personal data from EU websites to the United States despite CJEU…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Interpretation
Announced
Ireland · Apr 27, 2021
Irish DPC admits it does not decide GDPR complaints, handling 99.93% without decision
The Irish Data Protection Commissioner publicly stated that it does not issue decisions on GDPR complaints, with 99.93% of cases remaining without a decision. The DPC argued there is no obligation under the 2018 Act to produce a decision…
Irish Data Protection Commissioner (DPC) · General Data Protection Regulation
Low
Enforcement
Filed
France · Apr 6, 2021
noyb files complaint to French CNIL over Google’s Android Advertising ID tracking without consent
noyb lodged a complaint with the French Data Protection Authority (CNIL) alleging that Google’s Android Advertising Identifier (AAID) is installed on Android phones without user consent. The complaint cites the e‑Privacy Directive’s…
CNIL · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · Mar 18, 2021
Irish DPC cancels scheduled EU‑US data‑transfer hearing with European Parliament
Irish Data Protection Commission head Helen Dixon cancelled her participation in a European Parliament LIBE Committee hearing scheduled for 18 March 2021 after demanding to be heard alone. The hearing was intended to discuss EU‑US data…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
