High
Guidance
Published
European Union · Jul 24, 2020 · effective Jul 16, 2020
noyb provides step-by-step guide for EU users to stop US data transfers after Schrems II
The document outlines how data subjects can exercise GDPR rights to learn about and halt transfers of their personal data to the United States following the CJEU Schrems II judgment. It provides sample request letters for information…
European Commission · Standard Contractual Clauses
Moderate
Fine
In effect
France · Jun 19, 2020
French court upholds €50 million CNIL fine against Google
The French Data Protection Authority (CNIL) imposed a €50 million fine on Google for insufficient information and lack of valid consent for personalized ads. The Conseil d’État confirmed the CNIL's decision and affirmed its jurisdiction…
CNIL · General Data Protection Regulation
Low
Enforcement
Pending
Ireland · May 24, 2020
noyb files GDPR complaints against Facebook Group, warns of potential €2.5bn fine
Within hours of the GDPR becoming applicable on 25 May 2018, the non‑profit noyb filed three complaints against Facebook, Instagram and WhatsApp. The Irish DPC has kept the investigation confidential but may issue a fine of up to…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · May 20, 2020
noyb announces plan to file GDPR complaints over Apple Siri recordings
A former Apple employee alleges Siri records conversations without user activation. noyb says the practice may breach the GDPR and ePrivacy rules. noyb announces it will file complaints under Article 66 GDPR urgency procedure.
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · May 13, 2020
noyb files GDPR complaint against Google over Android Advertising ID tracking
noyb filed a formal GDPR complaint against Google for tracking users via the Android Advertising ID without a valid legal basis. The complaint was submitted on behalf of an Austrian citizen to the Austrian Data Protection Authority. GDPR…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Announced
Austria · Mar 31, 2020
Streaming services fail GDPR transparency requirements, report finds
A joint investigation by the Austrian Chamber of Labour and noyb evaluated eight streaming platforms against GDPR transparency obligations. The study found that most services provide insufficient information on data handling, retention…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Pending
Austria · Feb 26, 2020
Vienna Regional Court closes oral hearing in GDPR case against Facebook, judgment pending
The Vienna Regional Court for Civil Matters (LGfZRS) ended a nine‑hour oral hearing in a data‑protection lawsuit against Facebook. The court will issue a written judgment in the coming months and the case is expected to be appealed to…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
France · Dec 10, 2019
noyb files three GDPR complaints with CNIL over fake consent cookie banners on French sites
The privacy NGO noyb filed three formal complaints with the French Data Protection Authority (CNIL) alleging that CDiscount, Allocine.fr and Vanity Fair turn user rejections of cookies into "fake consent". The sites use the IAB…
CNIL · General Data Protection Regulation
Low
Lawsuit filed
Pending
Austria · Nov 12, 2019
Austrian court hears case accusing Facebook of processing data without consent under GDPR
In proceedings before the Vienna Regional Court, Facebook admitted to collecting and processing user data without consent since the GDPR took effect on May 25, 2018. The plaintiff argues that Facebook cannot rely on an alleged advertising…
EDPB · General Data Protection Regulation
Low
Court ruling
Decided
Austria · Jun 21, 2019
Austrian Supreme Court rejects Facebook's attempt to block GDPR model lawsuit
The Austrian Supreme Court dismissed all of Facebook's efforts to halt a model privacy lawsuit, confirming that any party may bring a claim under the GDPR. The court also ruled that national variations of the GDPR can no longer restrict…
EDPB · General Data Protection Regulation
Moderate
Fine
Announced
France · Jun 21, 2019
CNIL fines Google €50 million for GDPR ‘forced consent’ violations
The French data protection authority (CNIL) announced a €50 million fine against Google for GDPR violations related to forced consent. The penalty stems from complaints filed by noyb.eu and La Quadrature du Net. The announcement was made…
CNIL · General Data Protection Regulation
Low
Enforcement
Published
Austria · Dec 10, 2018
Austrian DSB decision on DerStandard.at ‘pay or okay’ subscription model
The Austrian Data Protection Authority (DSB) ruled that DerStandard.at’s subscription option requiring users to pay €6 per month for privacy instead of giving free consent is not voluntary under the GDPR. The decision sparked criticism…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Interpretation
Announced
Austria · Dec 10, 2018
Austrian DSB says “pay or okay” subscription model violates GDPR consent voluntariness
The Austrian Data Protection Authority (DSB) ruled that Der Standard's subscription offering, which ties refusal of consent to a €6 monthly fee, is not a voluntary choice under the GDPR. Max Schrems and other privacy experts criticized the…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Nov 12, 2018
Max Schrems discusses GDPR on CBS 60 Minutes (Nov 11, 2018)
On 11 November 2018, noyb director Max Schrems appeared on CBS's 60 Minutes to explain the benefits and challenges of the GDPR and how the organization enforces it. The interview highlighted the law's role in allowing Europeans to reclaim…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · May 25, 2018 · effective May 25, 2018
noyb files GDPR complaints against Google, Instagram, WhatsApp and Facebook for forced consent
On 25 May 2018, the privacy NGO noyb filed four complaints with DPAs in France, Belgium, Germany and Austria alleging that Google, Instagram, WhatsApp and Facebook use forced consent that violates GDPR Article 7(4). The complaints argue…
EDPB · General Data Protection Regulation
