Low
Enforcement
Filed
Luxembourg · Oct 21, 2021
noyb files GDPR complaint against Amazon Europe over opaque automated payment decisions
noyb lodged a complaint with Luxembourg's data protection authority alleging that Amazon Europe's automated "Monthly Invoice" payment rejections violate GDPR transparency and access requirements. The complaint cites the lack of explanation…
Luxembourg National Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Oct 18, 2021
noyb files GDPR complaint against Acxiom and CRIF Bürgel over illegal credit scores
noyb lodged a complaint in Germany alleging that address trader Acxiom and credit reference agency CRIF Bürgel illegally use personal data to calculate credit scores without consent, violating the GDPR and the German Federal Data…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
Ireland · Oct 15, 2021
Irish DPC orders noyb to remove draft decision from website
The Irish Data Protection Commission sent a take‑down request to privacy activist group noyb on 14 Oct 2021, ordering removal of a draft decision that allegedly strips Facebook users of GDPR rights. noyb refused, citing Austrian law and…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 13, 2021
noyb files complaints against cookie paywalls of seven German and Austrian news sites over unlawful consent
noyb filed complaints against the cookie paywalls of SPIEGEL.de, Zeit.de, heise.de, FAZ.net, derStandard.at, krone.at and t-online.de, arguing that the "pay or okay" model violates the GDPR's requirement for freely given consent. The…
EDPB · General Data Protection Regulation
Low
Enforcement
Decided
Austria · Aug 4, 2021
Austrian DPA orders credit agency CRIF to disclose scoring logic after GDPR complaint
The Austrian Data Protection Authority ruled that CRIF's credit assessment constitutes profiling under the GDPR and must disclose that the creditworthiness score was calculated only from address, gender, name and date of birth. CRIF must…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · May 26, 2021 · effective May 25, 2018
Digital Rights alliance files legal complaints across Europe against facial recognition company Clearview AI
Noyb and other EU digital‑rights groups submitted complaints to data‑protection authorities in France, Austria, Italy, Greece and the United Kingdom to halt Clearview AI's mass facial‑recognition surveillance. The regulators have three…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
France · Apr 6, 2021
noyb files complaint to French CNIL over Google’s Android Advertising ID tracking without consent
noyb lodged a complaint with the French Data Protection Authority (CNIL) alleging that Google’s Android Advertising Identifier (AAID) is installed on Android phones without user consent. The complaint cites the e‑Privacy Directive’s…
CNIL · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Mar 18, 2021
noyb files GDPR complaint against CRIF and AZ Direct over illegal data exchange
noyb lodged a GDPR complaint on 18 March 2021 against credit scoring firm CRIF GmbH and address publisher AZ Direct for exchanging personal data without a legal basis. The complaint alleges violations of the GDPR purpose‑limitation…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Pending
Austria · Mar 14, 2021
Austrian Supreme Court to consider referral of Facebook GDPR consent bypass case
The Austrian Supreme Court (OGH) has been asked to refer a case concerning Facebook's alleged bypass of GDPR consent rules to the CJEU. The dispute centers on Facebook's claim that a contractual duty to provide personalized advertising…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Feb 8, 2021
noyb files GDPR complaint against Austrian credit data broker KSV 1870
On 08.02.2021, the privacy NGO noyb lodged a GDPR complaint with the Austrian data protection authority alleging that KSV 1870 stores identification data from access requests in its commercial database, violating purpose‑limitation. The…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Announced
Germany · Jan 28, 2021 · deadline Feb 12, 2021
Hamburg DPA preliminarily deems Clearview AI’s biometric profiling of EU residents illegal and orders partial deletion
The Hamburg Data Protection Authority preliminarily found that Clearview AI’s collection of biometric profiles of Europeans violates the GDPR and ordered the deletion of the mathematical hash values of the complainant’s biometric profile.…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Fine
In effect
Norway (EEA) · Jan 26, 2021
Norwegian DPA fines Grindr €9.63 million for illegal sharing of sensitive data
The Norwegian Data Protection Authority imposed a fine of 100 Mio NOK on Grindr for sharing personal and sensitive data without valid consent. The authority found Grindr's consent mechanism invalid and highlighted the company's lack of…
Norwegian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Nov 16, 2020
noyb files complaints against Apple's IDFA tracking code
The privacy NGO noyb filed two complaints with the German and Spanish data protection authorities alleging that Apple's Identifier for Advertisers (IDFA) tracks users without consent, violating the EU e‑Privacy Directive. The complaints…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
Malta · Nov 12, 2020
noyb files complaint with Maltese DPA over C-Planet voter data breach
noyb filed a complaint with the Maltese Data Protection Authority against C-Planet IT Solutions for leaking personal data of 337,384 voters, including phone numbers, dates of birth and political opinions. NGOs Daphne Foundation and…
Maltese Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Aug 4, 2020
noyb files GDPR complaint against CRIF over arbitrary credit score
noyb.eu lodged a GDPR complaint with the Austrian Data Protection Authority against credit rating agency CRIF for assigning a credit score of 446 despite claiming no personal data was stored. The score caused an electricity supplier to…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Fine
In effect
France · Jun 19, 2020
French court upholds €50 million CNIL fine against Google
The French Data Protection Authority (CNIL) imposed a €50 million fine on Google for insufficient information and lack of valid consent for personalized ads. The Conseil d’État confirmed the CNIL's decision and affirmed its jurisdiction…
CNIL · General Data Protection Regulation
Low
Enforcement
Pending
Ireland · May 24, 2020
noyb files GDPR complaints against Facebook Group, warns of potential €2.5bn fine
Within hours of the GDPR becoming applicable on 25 May 2018, the non‑profit noyb filed three complaints against Facebook, Instagram and WhatsApp. The Irish DPC has kept the investigation confidential but may issue a fine of up to…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Announced
Austria · Mar 31, 2020
Streaming services fail GDPR transparency requirements, report finds
A joint investigation by the Austrian Chamber of Labour and noyb evaluated eight streaming platforms against GDPR transparency obligations. The study found that most services provide insufficient information on data handling, retention…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Pending
Austria · Feb 26, 2020
Vienna Regional Court closes oral hearing in GDPR case against Facebook, judgment pending
The Vienna Regional Court for Civil Matters (LGfZRS) ended a nine‑hour oral hearing in a data‑protection lawsuit against Facebook. The court will issue a written judgment in the coming months and the case is expected to be appealed to…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Norway (EEA) · Jan 14, 2020
Norwegian DPA receives GDPR complaints against Grindr and ad‑tech firms
The Norwegian Consumer Council, together with noyb, filed three formal GDPR complaints against Grindr and five ad‑tech companies (Twitter’s MoPub, AT&T’s AppNexus, OpenX, AdColony, Smaato) with the Norwegian Data Protection Authority. The…
Norwegian Data Protection Authority · General Data Protection Regulation
