Low
Appeal
Filed
Sweden · Jun 22, 2022
noyb files appeal against Swedish DPA's refusal to treat data subjects as parties in GDPR complaints
The Swedish Data Protection Authority (IMY) rejected a request by a data subject to participate in a GDPR access‑request procedure, stating the subject was not a party to the case. noyb filed an appeal to the administrative court in…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Low
Appeal
Filed
Spain · Jun 21, 2022
noyb files appeal against Spanish DPA decision restricting access to location data
noyb filed an appeal to the Audiencia Nacional challenging the Spanish DPA's decision that denied a customer access to his location data held by Virgin Telco. The DPA had sided with the telecom operator, limiting the GDPR right of access.…
Agencia Española de Protección de Datos (AEPD) · General Data Protection Regulation
Low
Appeal
Filed
Austria · Nov 15, 2021
noyb appeals Austrian DPA decision on cell‑phone location and traffic data to Federal Administrative Court
noyb filed a notice of appeal with Austria's Federal Administrative Court against the DSB's decision that A1 may refuse to provide location and traffic data to a user. The DSB argued the data are not personal because a third party could…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jul 20, 2021
Austrian Supreme Court refers Facebook case to CJEU over consent vs contract and awards €500 symbolic damages
The Austrian Supreme Court (OGH) referred four questions to the Court of Justice of the EU concerning Facebook's reliance on contract instead of consent under the GDPR. In a partial judgment, the court awarded Max Schrems €500 for lack of…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jul 16, 2021
Anniversary of the CJEU 'Schrems II' decision on EU‑US data transfers
Max Schrems marks one year since the CJEU's Schrems II ruling that declared EU‑US data transfers unlawful. He notes a lack of clear guidance, pending model complaints filed by noyb, and ongoing uncertainty around Standard Contractual…
European Data Protection Board · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jun 24, 2021
European Court of Justice invalidated Privacy Shield in July 2020
The European Court of Justice ruled that the EU‑US Privacy Shield framework is invalid, affecting cross‑border data transfers. The decision was highlighted in noyb’s 2020 Annual Report.
Privacy Shield
Low
Court ruling
Decided
Ireland · May 13, 2021
Irish High Court orders DPC to halt Facebook EU‑US data transfers
The Irish High Court ruled that the Irish Data Protection Commission must implement the CJEU judgment and stop Facebook's transfers of personal data from the EU to the United States. The court dismissed all reliefs sought by Facebook…
Irish Data Protection Commission · Schrems II judgment
Moderate
Court ruling
Pending
Austria · Mar 14, 2021
Austrian Supreme Court to consider referral of Facebook GDPR consent bypass case
The Austrian Supreme Court (OGH) has been asked to refer a case concerning Facebook's alleged bypass of GDPR consent rules to the CJEU. The dispute centers on Facebook's claim that a contractual duty to provide personalized advertising…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Luxembourg · Jan 25, 2021
Luxembourg administrative tribunal rules CNPD must handle GDPR complaints against US controllers
The Luxembourg administrative tribunal found that the CNPD wrongly dismissed complaints against US‑based data controllers Apollo and RocketReach and ordered the DPA to reopen the cases. The decision follows earlier appeals by privacy NGO…
Commission Nationale pour la Protection des Données (CNPD) · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 29, 2020
Vienna Superior Court orders Facebook to pay €500 and grant full data access
The Viennese Superior Court ruled that Facebook must pay Mr. Schrems €500 in emotional damages and provide him full access to all personal data the company holds about him. The court held that Facebook does not need user consent under GDPR…
EDPB · General Data Protection Regulation
Low
Court ruling
Decided
Ireland · Oct 29, 2020
Irish High Court orders DPC to cover most of Max Schrems' legal costs in EU‑US data transfer case
The Irish High Court ruled that the Irish Data Protection Commission must pay the legal costs of Max Schrems in his EU‑US data‑transfer case, except for three days of hearing costs which Facebook must cover. The decision follows a series…
Irish Data Protection Commission
Moderate
Court ruling
Decided
Ireland · Oct 12, 2020
Irish High Court grants judicial review to stop Facebook EU-US data transfers
The Irish High Court granted leave for a judicial review filed by privacy group noyb against the Irish Data Protection Commission (DPC) to compel a decision on Facebook's EU‑US data transfers. The action seeks to enforce the European Court…
Irish Data Protection Commission · Standard Contractual Clauses
Moderate
Court ruling
Announced
Ireland · Sep 14, 2020
Irish High Court grants Facebook leave to file Judicial Review, stays DPC EU‑US data‑flow investigation
The Irish High Court granted Facebook leave to bring a Judicial Review (Case No 2020/617 JR) and ordered a stay of the Data Protection Commission's ex officio investigation into Facebook's EU‑US data transfers. The DPC may resume the…
Data Protection Commission (DPC) · Standard Contractual Clauses
Moderate
Court ruling
Decided
European Union · Jul 16, 2020
CJEU invalidates EU‑US Privacy Shield and bars use of SCCs for Facebook
The Court of Justice of the European Union ruled that the EU‑US Privacy Shield is invalid because US surveillance laws conflict with EU fundamental rights. It also held that Standard Contractual Clauses cannot be used by Facebook and…
European Commission · Standard Contractual Clauses
Moderate
Court ruling
Decided
European Union · Jul 12, 2020
CJEU judgment limits EU‑US data outsourcing, confirms 'necessary' transfers exempt
The Court of Justice of the EU ruled that "necessary" transfers of personal data to the US are not affected by the case, while voluntary outsourcing of processing to US providers may violate the GDPR. The judgment confirms the invalidity…
European Commission · Standard Contractual Clauses
Moderate
Court ruling
Decided
Ireland · Jul 6, 2020
Irish High Court grants leave for judicial review of DPC's slow GDPR complaint procedure
The Irish High Court granted leave to noyb.eu to challenge the Data Protection Commission's handling of GDPR complaints against WhatsApp and Instagram. The DPC has taken two years to produce a first draft inquiry report, the first step of…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jun 30, 2020
Vienna Regional Court issues limited judgment in Schrems v. Facebook case
The Vienna Regional Court delivered a written judgment that largely summarised the facts and granted the plaintiff full access to his data and €500 symbolic damages. The judge limited legal analysis of GDPR compliance to 19 sentences and…
EDPB · General Data Protection Regulation
Low
Class action
Announced
Malta · May 27, 2020
Massive political data leak in Malta prompts class action
A database of 337,384 Maltese voters' personal information, including political affiliation, was publicly accessible for at least a year after being stored by C‑Planet IT Solutions in an open directory. The leak violates GDPR provisions on…
Maltese Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Pending
Austria · Feb 26, 2020
Vienna Regional Court closes oral hearing in GDPR case against Facebook, judgment pending
The Vienna Regional Court for Civil Matters (LGfZRS) ended a nine‑hour oral hearing in a data‑protection lawsuit against Facebook. The court will issue a written judgment in the coming months and the case is expected to be appealed to…
EDPB · General Data Protection Regulation
Low
Lawsuit filed
Filed
Ireland · Dec 18, 2019
Irish DPC files lawsuit against Facebook and Max Schrems over validity of SCCs
The Irish Data Protection Commissioner filed a lawsuit against Facebook and Max Schrems in the Irish High Court to refer the dispute on Standard Contractual Clauses to the CJEU. The case concerns whether SCCs can be used when US…
Irish Data Protection Commissioner · Standard Contractual Clauses
