Moderate
Enforcement
Filed
European Union · Aug 12, 2024
noyb files nine GDPR complaints against X over AI training of 60 million EU users
noyb has lodged GDPR complaints in Austria, Belgium, France, Greece, Ireland, Italy, the Netherlands, Spain and Poland alleging that X used personal data of over 60 million EU/EEA users to train its AI system without consent. The Irish…
Irish Data Protection Commission · General Data Protection Regulation
Low
Appeal
Filed
Sweden · Aug 12, 2024
noyb appeals to Swedish court over IMY's refusal to investigate data subject complaints
noyb has filed an appeal with the Kammarrätten i Stockholm challenging the Swedish Data Protection Authority's practice of forwarding complaints without investigation. The appeal follows a Supreme Administrative Court ruling that…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
High
Fine
In effect
European Union · Jul 29, 2024
European data protection authorities fined Meta, Spotify, Criteo and others in 2023 for GDPR violations
In 2023, the Irish DPC ordered Meta to pay €390 million and later €1.2 billion, the Swedish DPA fined Spotify €58 million SEK, and the French CNIL fined Criteo €40 million for breaches of consent and data‑subject rights under EU law.
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Italy · Jul 9, 2024
noyb files GDPR complaint against Microsoft’s Xandr for 0% compliance with data subject rights
Xandr, a Microsoft subsidiary, collects and shares personal data of millions of Europeans for targeted advertising, including sensitive categories. noyb filed a GDPR complaint with Italy’s Garante alleging breaches of Articles 5, 12, 15…
Italian data protection authority (Garante) · General Data Protection Regulation
Moderate
Investigation
Announced
Austria · Jun 4, 2024
noyb files complaints urging Austrian DSB to investigate Microsoft 365 Education for GDPR violations affecting children
noyb has lodged two complaints with Austria's data protection authority alleging that Microsoft 365 Education breaches GDPR rights of minors by shifting responsibility to schools, providing vague privacy information, and tracking users…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Apr 29, 2024
noyb files complaint with Austrian DPA over OpenAI's ChatGPT inaccurate personal data
noyb filed a complaint with the Austrian Data Protection Authority alleging that OpenAI cannot correct inaccurate personal data generated by ChatGPT, violating GDPR Articles 5, 15 and 16. The complaint seeks an investigation, compliance…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Feb 16, 2024
noyb files complaint against German credit agency SCHUFA for GDPR access violations
noyb has lodged a complaint and report with the Hessian data protection authority alleging that SCHUFA blocks free access to personal data required under Article 15 GDPR. The agency allegedly uses manipulative designs to push paid products…
Hessian data protection authority · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jan 28, 2024
Survey finds 74% of insiders say authorities would find GDPR violations in average EU company
A noyb survey of over 1,000 data‑protection professionals reports that 74% believe authorities would discover relevant GDPR violations during on‑site inspections. Respondents cite lack of clear DPA decisions, fines, and public enforcement…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jan 4, 2024
noyb files complaint against Austrian creditors’ association KSV1870 for charging for GDPR Article 15 access
noyb lodged a complaint with the Austrian data protection authority alleging that KSV1870 charges €43 for a data‑access service that must be provided free of charge under Article 15 GDPR. The organization allegedly uses misleading website…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Dec 7, 2023
CJEU rules automated credit scoring violates GDPR and expands judicial review of DPAs
The Court of Justice of the European Union issued two judgments: one confirming national courts can fully review DPA decisions, and another finding that automatically calculated credit scores breach Article 22 GDPR. The rulings require…
EDPB · General Data Protection Regulation
Low
Court ruling
Decided
Austria · Oct 9, 2023
Austrian court orders streaming service DAZN to comply with GDPR access request after 5 years
The Austrian Federal Administrative Court ruled on 6 September 2023 that DAZN must provide the missing information requested under the GDPR right of access. DAZN complied with the court order on 13 September 2023, completing the request…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Jul 4, 2023
EU Commission proposes GDPR Procedures Regulation that may limit citizens' procedural rights
The European Commission has issued a proposal to create a GDPR Procedures Regulation to address cooperation gaps among DPAs. Critics say the draft strips citizens of procedural rights and gives companies extensive participation rights. The…
European Commission · General Data Protection Regulation
Moderate
Amendment
Passed
Ireland · Jun 28, 2023
Ireland passes amendment to Data Protection Act allowing DPC to declare GDPR cases confidential
The Irish government has passed an amendment to the Data Protection Act, creating Section 26A which permits the Data Protection Commission to declare documents relating to pending GDPR procedures confidential and criminalise their…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Moderate
Amendment
Pending
Ireland · Jun 26, 2023
Irish government adds Section 26A to Data Protection Act, criminalising reporting on DPC procedures
A last‑minute amendment (Section 26A) was inserted into the Courts and Civil Law (Miscellaneous Provisions) Bill 2022, allowing the Irish Data Protection Commissioner to declare most of its procedures confidential. The amendment would make…
Irish Data Protection Commissioner (DPC) · General Data Protection Regulation
Moderate
Fine
In effect
France · Jun 22, 2023
French CNIL fines Criteo €40 million for GDPR violations
The French Data Protection Authority (CNIL) fined Criteo €40 million for violating the GDPR, including lack of valid consent, transparency, and failure to respect the right to erasure and access. The enforcement followed complaints filed…
CNIL · General Data Protection Regulation
Moderate
Fine
In effect
Sweden · Jun 13, 2023
Swedish Data Protection Authority fines Spotify €5 million for GDPR access violations
The Swedish Data Protection Authority (IMY) imposed a fine of 58 million Swedish crowns (≈ €5 million) on Spotify for not fully complying with users' right of access under the GDPR. The authority ordered Spotify to provide the complete set…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Low
Enforcement
Filed
European Union · Jun 1, 2023
Credit agency CRIF systematically withholds data from consumers, noyb files complaint
noyb has filed a complaint with the data protection authority alleging that CRIF violates GDPR Article 15 by providing incomplete access to personal data. The complaint cites systematic withholding of source information and limited…
EDPB · General Data Protection Regulation
Moderate
Data protection authority action
Announced
Malta · May 17, 2023
Maltese DPA orders C-PLANET to disclose data source within 20 days or face fine
The Maltese Data Protection Authority (IDPC) ordered IT company C-PLANET to provide details on the source of personal data collected on voters within 20 days. Failure to comply will result in a proportionate and dissuasive fine under the…
Maltese Data Protection Authority (IDPC) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · May 4, 2023
CJEU rules GDPR right of access must include documents and database extracts
The Court of Justice of the European Union held that a data subject’s right of access under Article 15 GDPR includes providing the data in context, such as relevant documents and database extracts. The ruling arose from a complaint against…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Mar 17, 2023
Austrian Federal Administrative Court allows mobile providers to refuse access requests for location data without proof of exclusive use
The Austrian Federal Administrative Court (BVwG) ruled that A1 Telekom Austria may deny a data subject's request for traffic and location data unless the subject can prove exclusive use of the phone. The court deemed location data…
EDPB · General Data Protection Regulation
