Low
Enforcement
Announced
Ireland · Mar 18, 2021
Irish DPC cancels scheduled EU‑US data‑transfer hearing with European Parliament
Irish Data Protection Commission head Helen Dixon cancelled her participation in a European Parliament LIBE Committee hearing scheduled for 18 March 2021 after demanding to be heard alone. The hearing was intended to discuss EU‑US data…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Mar 18, 2021
noyb files GDPR complaint against CRIF and AZ Direct over illegal data exchange
noyb lodged a GDPR complaint on 18 March 2021 against credit scoring firm CRIF GmbH and address publisher AZ Direct for exchanging personal data without a legal basis. The complaint alleges violations of the GDPR purpose‑limitation…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Pending
Austria · Mar 14, 2021
Austrian Supreme Court to consider referral of Facebook GDPR consent bypass case
The Austrian Supreme Court (OGH) has been asked to refer a case concerning Facebook's alleged bypass of GDPR consent rules to the CJEU. The dispute centers on Facebook's claim that a contractual duty to provide personalized advertising…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Feb 8, 2021
noyb files GDPR complaint against Austrian credit data broker KSV 1870
On 08.02.2021, the privacy NGO noyb lodged a GDPR complaint with the Austrian data protection authority alleging that KSV 1870 stores identification data from access requests in its commercial database, violating purpose‑limitation. The…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Announced
Germany · Jan 28, 2021 · deadline Feb 12, 2021
Hamburg DPA preliminarily deems Clearview AI’s biometric profiling of EU residents illegal and orders partial deletion
The Hamburg Data Protection Authority preliminarily found that Clearview AI’s collection of biometric profiles of Europeans violates the GDPR and ordered the deletion of the mathematical hash values of the complainant’s biometric profile.…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Guidance
Published
European Union · Jan 27, 2021
noyb urges stronger GDPR enforcement on European Data Protection Day
noyb highlights that despite the GDPR's strong provisions, compliance remains low and enforcement insufficient. The organization calls on data protection authorities and companies to move from paper rights to real protection, citing the…
EDPB · General Data Protection Regulation
Moderate
Fine
In effect
Norway (EEA) · Jan 26, 2021
Norwegian DPA fines Grindr €9.63 million for illegal sharing of sensitive data
The Norwegian Data Protection Authority imposed a fine of 100 Mio NOK on Grindr for sharing personal and sensitive data without valid consent. The authority found Grindr's consent mechanism invalid and highlighted the company's lack of…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Luxembourg · Jan 25, 2021
Luxembourg administrative tribunal rules CNPD must handle GDPR complaints against US controllers
The Luxembourg administrative tribunal found that the CNPD wrongly dismissed complaints against US‑based data controllers Apollo and RocketReach and ordered the DPA to reopen the cases. The decision follows earlier appeals by privacy NGO…
Commission Nationale pour la Protection des Données (CNPD) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jan 22, 2021
noyb files complaint against European Parliament over US data transfers and deceptive cookie banners
noyb filed a complaint with the European Data Protection Supervisor on behalf of six MEPs alleging illegal transfers of personal data to US providers Google and Stripe and misleading cookie banners on the Parliament's COVID‑19 testing…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Settlement
Settled
Ireland · Jan 13, 2021
Irish DPC settles judicial review, pledges swift decision on Facebook EU‑US data transfers
The Irish Data Protection Commission (DPC) settled a judicial review with Max Schrems and agreed to decide quickly on Facebook's EU‑US data flows. The settlement allows Schrems to be heard in the DPC's own‑volition procedure and to access…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 29, 2020
Vienna Superior Court orders Facebook to pay €500 and grant full data access
The Viennese Superior Court ruled that Facebook must pay Mr. Schrems €500 in emotional damages and provide him full access to all personal data the company holds about him. The court held that Facebook does not need user consent under GDPR…
EDPB · General Data Protection Regulation
Low
Interpretation
Announced
United States (federal) · Dec 9, 2020
US Senate Commerce Committee holds hearing on EU‑US data transfers after Schrems II
The Committee on Commerce, Science and Transportation of the United States Senate scheduled a hearing on EU‑US data transfers following the CJEU Schrems II decision. Witnesses include representatives from the FTC, the Department of…
EU‑US Privacy Shield
Low
Enforcement
Filed
Germany · Nov 16, 2020
noyb files complaints against Apple's IDFA tracking code
The privacy NGO noyb filed two complaints with the German and Spanish data protection authorities alleging that Apple's Identifier for Advertisers (IDFA) tracks users without consent, violating the EU e‑Privacy Directive. The complaints…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
Malta · Nov 12, 2020
noyb files complaint with Maltese DPA over C-Planet voter data breach
noyb filed a complaint with the Maltese Data Protection Authority against C-Planet IT Solutions for leaking personal data of 337,384 voters, including phone numbers, dates of birth and political opinions. NGOs Daphne Foundation and…
Maltese Data Protection Authority · General Data Protection Regulation
Low
Court ruling
Decided
Ireland · Oct 29, 2020
Irish High Court orders DPC to cover most of Max Schrems' legal costs in EU‑US data transfer case
The Irish High Court ruled that the Irish Data Protection Commission must pay the legal costs of Max Schrems in his EU‑US data‑transfer case, except for three days of hearing costs which Facebook must cover. The decision follows a series…
Irish Data Protection Commission
Low
Guidance
Published
Belgium · Oct 29, 2020
Belgian Ministerial Decree approves noyb as qualified entity to file class actions
In September, the Belgian Official Journal published a Ministerial Decree approving noyb as a qualified entity under the collective action scheme of the Belgian Code of Economic Law. This authorisation enables noyb to file representative…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Oct 29, 2020
noyb reaches 3,000 subscribers for GDPRtoday newsletter
The organization noyb announced that its GDPRtoday newsletter has surpassed 3,000 subscribers within ten months. The newsletter provides English summaries of GDPR decisions from across Europe and has translated and summarized over 500…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Oct 21, 2020
noyb files GDPR complaint against Wizz Air over charged rectification request
On 21.10.2020 noyb filed a GDPR complaint with the Austrian Data Protection Authority against Wizz Air for charging €35 to update a passenger's surname. The airline required the passenger to call a paid hotline to make the change…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Oct 13, 2020
noyb files GDPR complaint against Austrian address broker AZ Direct for lack of source and recipient transparency
noyb lodged a GDPR complaint with the Austrian data protection authority against AZ Direct Österreich GmbH for refusing to disclose the origin and recipients of address data. The company claimed it was too burdensome to keep precise…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Oct 12, 2020
Irish High Court grants judicial review to stop Facebook EU-US data transfers
The Irish High Court granted leave for a judicial review filed by privacy group noyb against the Irish Data Protection Commission (DPC) to compel a decision on Facebook's EU‑US data transfers. The action seeks to enforce the European Court…
Irish Data Protection Commission · Standard Contractual Clauses
