Moderate
Enforcement
Pending
European Union · Aug 14, 2023
noyb reports 23 years of illegal EU‑US data transfers and limited enforcement actions
The EU Court of Justice invalidated the Safe Harbor and Privacy Shield deals in 2015 and 2020, making all EU‑US data transfers since 2000 illegal. Despite this, most DPAs have not acted on 101 complaints filed by noyb, with only Sweden…
European Commission · EU-U.S. Data Privacy Framework
Moderate
FRAMEWORK UPDATE
Announced
European Union · Aug 14, 2023
EU and US announce new Trans-Atlantic Data Privacy Framework amid 23 years of illegal transfers
The European Commission and the United States agreed in mid‑July 2023 on a new Trans‑Atlantic Data Privacy Framework (TADPF), a successor to the invalidated Safe Harbor and Privacy Shield. noyb reports that most EU data protection…
European Commission · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Aug 1, 2023
Meta to switch to consent for behavioral ads after EU litigation
Meta announced it will seek user consent before showing behavioral ads in the EU and Switzerland, changing its legal basis from legitimate interest to consent. The move follows litigation by noyb, decisions by the EDPB and the CJEU, and a…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Settled
Belgium · Jul 19, 2023
Belgian DPA settles with news outlets, allowing them to avoid GDPR compliance
Fifteen Belgian news sites paid €10,000 each in a settlement with the Belgian Data Protection Authority, which closed the cases without ordering changes to unlawful cookie banners. noyb filed complaints to force the DPA to reopen…
Belgian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
In effect
Norway (EEA) · Jul 17, 2023 · effective Aug 4, 2023
Norwegian DPA temporarily bans Meta’s behavioral advertising on Facebook and Instagram
The Norwegian Data Protection Authority (Datatilsynet) issued a temporary ban on Meta's use of behavioral advertising on Facebook and Instagram, effective from August 4 for at least three months. The ban remains until Meta can demonstrate…
Datatilsynet · General Data Protection Regulation
Moderate
Proposed regulation
Announced
European Union · Jul 10, 2023
EU Commission adopts third Trans-Atlantic Data Privacy Framework, likely to face CJEU challenge
The European Commission has introduced a new Trans-Atlantic Data Privacy Framework as its third attempt to secure an EU‑US data transfer adequacy decision. Privacy‑rights group noyb says it will challenge the decision before the Court of…
European Commission · EU-U.S. Data Privacy Framework
Moderate
Court ruling
Decided
Germany · Jul 4, 2023
CJEU rules Meta must rely on consent for advertising, limiting GDPR bypass attempts
The Court of Justice of the EU held that Meta may only process personal data for core services and must obtain freely given consent for advertising and data sharing. The judgment rejects Meta's reliance on contractual necessity and…
EDPB · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · Jul 4, 2023
EU Commission proposes GDPR Procedures Regulation that may limit citizens' procedural rights
The European Commission has issued a proposal to create a GDPR Procedures Regulation to address cooperation gaps among DPAs. Critics say the draft strips citizens of procedural rights and gives companies extensive participation rights. The…
European Commission · General Data Protection Regulation
Moderate
Fine
In effect
Sweden · Jul 3, 2023
Swedish DPA fines Tele2 €1M and CDON €0.3M for illegal use of Google Analytics
The Swedish Data Protection Authority (IMY) issued decisions against four companies for unlawful EU‑US data transfers via Google Analytics. It imposed a fine of 12 mio SEK (≈€1 M) on Tele2 and 300 000 SEK on CDON. The authority also…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Amendment
Passed
Ireland · Jun 28, 2023
Ireland passes amendment to Data Protection Act allowing DPC to declare GDPR cases confidential
The Irish government has passed an amendment to the Data Protection Act, creating Section 26A which permits the Data Protection Commission to declare documents relating to pending GDPR procedures confidential and criminalise their…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Moderate
Amendment
Proposed
Ireland · Jun 26, 2023
Irish Parliament debates amendment to criminalise reporting on DPC procedures
A last‑minute amendment (Section 26A) was added to the Courts and Civil Law (Miscellaneous Provisions) Bill 2022 that would allow the Irish Data Protection Commissioner to declare its procedures confidential and make reporting on them a…
Irish Data Protection Commissioner · General Data Protection Regulation
Moderate
Amendment
Pending
Ireland · Jun 26, 2023
Irish government adds Section 26A to Data Protection Act, criminalising reporting on DPC procedures
A last‑minute amendment (Section 26A) was inserted into the Courts and Civil Law (Miscellaneous Provisions) Bill 2022, allowing the Irish Data Protection Commissioner to declare most of its procedures confidential. The amendment would make…
Irish Data Protection Commissioner (DPC) · General Data Protection Regulation
Moderate
Enforcement
Filed
Belgium · Jun 23, 2023
noyb files complaint against TeleSign for unlawful profiling of mobile users
noyb filed a complaint with the Belgian Data Protection Authority alleging that TeleSign receives phone data from BICS and creates reputation scores without consent, violating the GDPR. The complaint cites the use of AI-generated trust…
Belgian Data Protection Authority · General Data Protection Regulation
Moderate
Fine
In effect
France · Jun 22, 2023
French CNIL fines Criteo €40 million for GDPR violations
The French Data Protection Authority (CNIL) fined Criteo €40 million for violating the GDPR, including lack of valid consent, transparency, and failure to respect the right to erasure and access. The enforcement followed complaints filed…
CNIL · General Data Protection Regulation
Moderate
Fine
In effect
Sweden · Jun 13, 2023
Swedish Data Protection Authority fines Spotify €5 million for GDPR access violations
The Swedish Data Protection Authority (IMY) imposed a fine of 58 million Swedish crowns (≈ €5 million) on Spotify for not fully complying with users' right of access under the GDPR. The authority ordered Spotify to provide the complete set…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · May 23, 2023
EU Commission proposes GDPR Procedures Regulation to address enforcement delays
Noyb calls for an EU procedural regulation to fix widespread delays and procedural tricks in GDPR enforcement across member states. The European Commission has indicated interest in such a regulation and also in the upcoming EU Collective…
European Commission · General Data Protection Regulation
Moderate
Fine
Announced
Ireland · May 22, 2023
Irish DPC imposes €1.2 billion fine on Meta for EU‑US data transfers
The Irish Data Protection Commission, backed by the European Data Protection Board, ordered Meta to cease all transfers of European personal data to the United States and to return data already transferred to EU data centres. The decision…
Irish Data Protection Commission · Standard Contractual Clauses
Moderate
Data protection authority action
Announced
Malta · May 17, 2023
Maltese DPA orders C-PLANET to disclose data source within 20 days or face fine
The Maltese Data Protection Authority (IDPC) ordered IT company C-PLANET to provide details on the source of personal data collected on voters within 20 days. Failure to comply will result in a proportionate and dissuasive fine under the…
Maltese Data Protection Authority (IDPC) · General Data Protection Regulation
Moderate
Data protection authority action
Decided
Austria · May 10, 2023
Austrian DPA deems Clearview AI’s biometric data processing illegal, orders deletion, no fine
The Austrian Data Protection Authority ruled that Clearview AI may not process the complainant’s biometric data and must delete the data. The decision cites GDPR violations for scraping and selling personal data of Europeans. No monetary…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · May 4, 2023
CJEU rules GDPR right of access must include documents and database extracts
The Court of Justice of the European Union held that a data subject’s right of access under Article 15 GDPR includes providing the data in context, such as relevant documents and database extracts. The ruling arose from a complaint against…
EDPB · General Data Protection Regulation
