Moderate
Fine
Decided
European Union · Jul 21, 2022
6.3 million Euro fine imposed on Grindr for GDPR violations
noyb’s complaints resulted in a 6.3 million Euro fine against the gay dating app Grindr for breaching the GDPR. The fine was highlighted in noyb’s 2021 Annual Report.
EDPB · General Data Protection Regulation
High
Fine
In effect
Greece · Jul 13, 2022
Greek DPA fines Clearview AI €20 million and bans biometric processing
The Greek Data Protection Authority imposed a €20 million fine on Clearview AI and prohibited the company from processing biometric data of individuals in Greece. Clearview must delete all existing facial‑recognition data of Greek citizens…
Greek Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
In effect
European Union · Jul 5, 2022
EU DPAs ban use of Google Analytics over unlawful US data transfers
The Italian Data Protection Authority (GPDP) declared Google Analytics illegal because it transfers personal data to the United States. French CNIL and Austrian DPA issued similar orders, requiring websites to stop using the service. The…
Italian Data Protection Authority (GPDP) · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · May 22, 2022
Open Letter warns EU‑US data transfer deal lacks material US law changes
The open letter published on 2022‑05‑22 criticises the announced Trans‑Atlantic Data Privacy Framework for relying on US executive orders without substantive changes to US surveillance law. It argues that the framework repeats the…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
Austria · May 2, 2022
Austrian DPA rejects risk‑based approach for EU‑US data transfers, deems Google IP anonymisation insufficient
The Austrian Data Protection Authority issued a decision stating that the GDPR does not permit a risk‑based approach for transfers to insecure third countries such as the United States. It also concluded that Google’s IP anonymisation does…
Austrian Data Protection Authority · General Data Protection Regulation
High
Fine
In effect
Italy · Mar 10, 2022
Italian DPA fines Clearview AI €20 million and bans biometric processing
The Italian data protection authority imposed a €20 million fine on Clearview AI and prohibited the company from processing biometric data of individuals in Italy. Clearview must delete all existing biometric data of Italian citizens and…
Italian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
DE-HE · Feb 25, 2022
noyb files complaint against giropay for processing detailed purchase data
The German payment service giropay stores item‑by‑item purchase information from online shops, including health‑related and sexual‑preference data. noyb lodged a complaint with the Hessian State Commissioner for Data Protection, alleging…
Hessian State Commissioner for Data Protection and Freedom of Information · General Data Protection Regulation
Moderate
Fine
In effect
Malta · Jan 20, 2022
Malta data protection commissioner fines C-Planet €65,000 for illegal voter data collection
The Malta Information & Data Protection Commissioner (IDPC) imposed a €65,000 fine on IT company C-Planet for unlawfully collecting personal data of 98% of Maltese voters, including political preferences. The IDPC found the processing…
Information & Data Protection Commissioner (IDPC) · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · Dec 12, 2021
Irish DPC sends threat letters to noyb over Facebook ROPA publication
noyb published Facebook's four‑page Record of Processing Activities (ROPA) required by Article 30 GDPR. The Irish Data Protection Commission, which received the ROPA on 27.9.2018, sent angry letters to noyb demanding the removal of the…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Guidance
Published
Ireland · Dec 4, 2021
Irish DPC tried to embed Facebook consent bypass into EDPB Guidelines, but final 2019 guidelines omitted it
A letter shows the Irish DPC held ten meetings with Facebook and agreed on a GDPR bypass by moving consent into terms and conditions. The DPC then drafted EDPB guideline language to allow this approach, but other DPAs criticised it…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Low
Enforcement
Announced
Austria · Nov 28, 2021
Austrian DPA rejects Facebook's confidentiality claim in GDPR data‑transfer dispute
The Austrian Data Protection Authority (DSB) rejected Facebook's claim that certain documents were confidential, providing all documents to the Irish DPC. The DSB also reminded Facebook that official Austrian procedures must be conducted…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Appeal
Filed
Austria · Nov 15, 2021
noyb appeals Austrian DPA decision on cell‑phone location and traffic data to Federal Administrative Court
noyb filed a notice of appeal with Austria's Federal Administrative Court against the DSB's decision that A1 may refuse to provide location and traffic data to a user. The DSB argued the data are not personal because a third party could…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Nov 11, 2021
noyb files GDPR complaint against Grindr over selfie ID requirement
noyb lodged a GDPR complaint with the Austrian Data Protection Authority alleging that Grindr's policy of requiring a selfie with a passport and email paper violates data minimisation and the right of access. The complainant was denied…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Announced
Ireland · Oct 15, 2021
Irish DPC orders noyb to remove draft decision from website
The Irish Data Protection Commission sent a take‑down request to privacy activist group noyb on 14 Oct 2021, ordering removal of a draft decision that allegedly strips Facebook users of GDPR rights. noyb refused, citing Austrian law and…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 13, 2021
noyb files complaints against cookie paywalls of seven German and Austrian news sites over unlawful consent
noyb filed complaints against the cookie paywalls of SPIEGEL.de, Zeit.de, heise.de, FAZ.net, derStandard.at, krone.at and t-online.de, arguing that the "pay or okay" model violates the GDPR's requirement for freely given consent. The…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jul 20, 2021
Austrian Supreme Court refers Facebook case to CJEU over consent vs contract and awards €500 symbolic damages
The Austrian Supreme Court (OGH) referred four questions to the Court of Justice of the EU concerning Facebook's reliance on contract instead of consent under the GDPR. In a partial judgment, the court awarded Max Schrems €500 for lack of…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jul 19, 2021
noyb reports 2.5‑year delay in GDPR access‑request complaints against streaming services
In January 2019 noyb filed complaints against eight streaming services for failing to comply with the GDPR right of access. After two and a half years only one complaint was resolved after noyb took the responsible authority to court. The…
EDPB · General Data Protection Regulation
Moderate
Proposed regulation
Published
European Union · Jun 14, 2021
noyb and CSL propose Advanced Data Protection Control browser signal to replace cookie banners
noyb and the Sustainable Computing Lab released a technical proposal for an "Advanced Data Protection Control" (ADPC) browser signal. The signal would allow browsers to automatically convey user consent or opt‑in preferences to websites…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · May 26, 2021 · effective May 25, 2018
Digital Rights alliance files legal complaints across Europe against facial recognition company Clearview AI
Noyb and other EU digital‑rights groups submitted complaints to data‑protection authorities in France, Austria, Italy, Greece and the United Kingdom to halt Clearview AI's mass facial‑recognition surveillance. The regulators have three…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Mar 18, 2021
noyb files GDPR complaint against CRIF and AZ Direct over illegal data exchange
noyb lodged a GDPR complaint on 18 March 2021 against credit scoring firm CRIF GmbH and address publisher AZ Direct for exchanging personal data without a legal basis. The complaint alleges violations of the GDPR purpose‑limitation…
Austrian Data Protection Authority · General Data Protection Regulation
