Moderate
Guidance
Published
France · Oct 16, 2026
CNIL guidance on reconstituting professional email addresses and data subject rights
The CNIL explains that organisations may deduce a professional email address from publicly available information, but must comply with the GDPR and specific commercial prospecting rules. Data subjects must be informed clearly about the…
CNIL · RGPD
High
Guidance
In effect
United States (federal) · Oct 15, 2026 · effective Nov 24, 2026
Farm Credit Administration amends employee payroll system of records under Privacy Act, effective Nov 24, 2026
The Farm Credit Administration announced an amendment to its FCA-1 system of records covering employee attendance, leave, and payroll. The amendment updates the categories of individuals and records maintained and revises the policies and…
Farm Credit Administration · Privacy Act of 1974
Moderate
Guidance
Published
France · Oct 2, 2026
CNIL explains when data‑breach victims can claim compensation under the GDPR
The CNIL outlines that individuals can seek damages only if a GDPR breach caused a real material or moral injury, and they can prove a causal link. Compensation is awarded by a judge, not the CNIL, and the regulator may only impose…
CNIL · RGPD
High
Guidance
Published
France · Oct 1, 2026 · effective Oct 1, 2026
CNIL and Cybermalveillance.gouv.fr release guide for individuals on personal data breach response
The French data protection authority (CNIL) and Cybermalveillance.gouv.fr have published a practical support document titled “Violation de données personnelles, que faire en 3 étapes clés ?”. The guide provides a three‑step checklist for…
CNIL
Low
Guidance
Announced
United States (federal) · Sep 16, 2026
EPIC report finds companies hinder personal data access under state privacy laws
The Electronic Privacy Information Center reports that many large firms make it difficult for consumers to obtain their personal data, despite state privacy statutes. EPIC notes that small fines and warning letters often have limited…
Moderate
Guidance
In effect
France · Sep 10, 2026 · effective Sep 1, 2026
CNIL guidance on data‑protection obligations under the electronic invoicing reform effective 1 Sept 2026
The CNIL explains the data‑protection implications of the French electronic invoicing reform that entered into force on 1 Sept 2026. It details which personal data may be processed, the roles of issuers, receivers and certified platforms…
CNIL · réforme relative à la facturation électronique
Moderate
Guidance
Published
European Union · Feb 11, 2026
EU DPAs reject key proposals in Digital Omnibus GDPR changes
The European Data Protection Board and the European Data Protection Supervisor issued a joint opinion rejecting the Commission's proposal to narrow the definition of personal data and to restrict the right of access. They also raised…
European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) · ePrivacy Directive
Moderate
Guidance
Published
United States (federal) · Mar 31, 2025
2024 HMDA Modified LAR Data Now Available on FFIEC Platform
The Home Mortgage Disclosure Act (HMDA) Modified Loan Application Register data for 2024 have been released on the FFIEC HMDA Platform for about 4,898 filers. The loan‑level data are modified to protect consumer privacy and are now…
Consumer Financial Protection Bureau · Home Mortgage Disclosure Act
Moderate
Interpretation
In effect
European Union · Dec 2, 2024 · effective Dec 2, 2024
noyb qualified as EU 'Qualified Entity' to bring collective GDPR redress actions
noyb has been approved as a Qualified Entity under Directive (EU) 2020/1828, allowing it to bring collective injunctions and redress actions across the EU. Approvals were issued by Austria's Bundeskartellamt on 2 December 2024 and…
Bundeskartellamt; Irish Ministry for Justice · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · May 22, 2022
Open Letter warns EU‑US data transfer deal lacks material US law changes
The open letter published on 2022‑05‑22 criticises the announced Trans‑Atlantic Data Privacy Framework for relying on US executive orders without substantive changes to US surveillance law. It argues that the framework repeats the…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
Austria · May 2, 2022
Austrian DPA rejects risk‑based approach for EU‑US data transfers, deems Google IP anonymisation insufficient
The Austrian Data Protection Authority issued a decision stating that the GDPR does not permit a risk‑based approach for transfers to insecure third countries such as the United States. It also concluded that Google’s IP anonymisation does…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Interpretation
Announced
Ireland · Apr 27, 2021
Irish DPC admits it does not decide GDPR complaints, handling 99.93% without decision
The Irish Data Protection Commissioner publicly stated that it does not issue decisions on GDPR complaints, with 99.93% of cases remaining without a decision. The DPC argued there is no obligation under the 2018 Act to produce a decision…
Irish Data Protection Commissioner (DPC) · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Oct 29, 2020
noyb reaches 3,000 subscribers for GDPRtoday newsletter
The organization noyb announced that its GDPRtoday newsletter has surpassed 3,000 subscribers within ten months. The newsletter provides English summaries of GDPR decisions from across Europe and has translated and summarized over 500…
EDPB · General Data Protection Regulation
High
Guidance
Published
European Union · Jul 24, 2020 · effective Jul 16, 2020
noyb provides step-by-step guide for EU users to stop US data transfers after Schrems II
The document outlines how data subjects can exercise GDPR rights to learn about and halt transfers of their personal data to the United States following the CJEU Schrems II judgment. It provides sample request letters for information…
European Commission · Standard Contractual Clauses
Moderate
Guidance
Published
European Union · Apr 2, 2020
Noyb reports video conferencing tools' privacy policies fall short of GDPR obligations
The report examined the privacy policies of six video‑conferencing services (Zoom, Webex Meetings, Meeting, Skype, Teams, Wire) and found they lack clear GDPR information, such as basic rights and recipient details. An update on…
EDPB · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Jun 5, 2019
noyb and Access Now host workshop on GDPR enforcement actions in Vienna
The workshop “One year after GDPR: Advancing rights through effective enforcement actions” was held May 8‑10, 2019 in Vienna. It gathered NGOs, public authorities and researchers to discuss practical aspects of GDPR enforcement, noting…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Dec 8, 2018
Noyb reports controllers limit GDPR rights to specific request formats
Noyb notes that many data controllers use automated systems that restrict how data subjects can exercise their GDPR rights, often limiting requests to specific formats that may not serve the data subject's interests. The organization…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Nov 12, 2018
Max Schrems discusses GDPR on CBS 60 Minutes (Nov 11, 2018)
On 11 November 2018, noyb director Max Schrems appeared on CBS's 60 Minutes to explain the benefits and challenges of the GDPR and how the organization enforces it. The interview highlighted the law's role in allowing Europeans to reclaim…
EDPB · General Data Protection Regulation
