Moderate
Data protection authority action
Published
DE-BAVARIA · Feb 5, 2024
Bavarian DPA declares CRIF‑Acxiom data trading illegal under GDPR
The Bavarian data protection authority ruled that credit reference agency CRIF illegally purchased personal data from address trader Acxiom and breached GDPR purpose‑limitation and information duties. The decision follows a similar…
Bavarian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jan 28, 2024
Survey finds 74% of insiders say authorities would find GDPR violations in average EU company
A noyb survey of over 1,000 data‑protection professionals reports that 74% believe authorities would discover relevant GDPR violations during on‑site inspections. Respondents cite lack of clear DPA decisions, fines, and public enforcement…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Nov 28, 2023
noyb files GDPR complaint against Meta over “Pay or Okay” tracking fee
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Meta’s practice of charging users up to €251.88 a year to avoid personalized advertising violates GDPR consent requirements. The complaint references the…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Nov 16, 2023
noyb files complaint with EDPS over EU Commission’s political micro‑targeting ads on X
noyb lodged a complaint with the European Data Protection Supervisor alleging the EU Commission used unlawful micro‑targeting on X to promote its chat‑control proposal. The ads targeted users based on political views and religious beliefs…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · Oct 3, 2023
Meta proposes 'Pay for your Rights' model charging EU users €160/year for non‑consent
Meta plans to charge EU users €160 per year if they do not consent to the processing of their personal data on Facebook and Instagram. The proposal references an obiter dictum from the CJEU case C‑252/21 that an alternative to ads may be…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
Decided
Norway (EEA) · Sep 29, 2023
Norwegian Privacy Appeals Board upholds €5.8 million fine against Grindr
The Norwegian Privacy Appeals Board confirmed the Norwegian Data Protection Authority's fine of NOK 65 million against the dating app Grindr for sharing sensitive personal data with third parties. The fine, approximately €5.8 million…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 31, 2023
noyb files complaints against Fitbit in Austria, Netherlands, Italy over forced consent for data transfers
noyb lodged three complaints with the Austrian, Dutch and Italian data protection authorities alleging that Fitbit forces new EU users to consent to transfers of personal and health data to the United States and other countries. The…
Austrian Data Protection Authority, Dutch Data Protection Authority, Italian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Aug 14, 2023
noyb reports 23 years of illegal EU‑US data transfers and limited enforcement actions
The EU Court of Justice invalidated the Safe Harbor and Privacy Shield deals in 2015 and 2020, making all EU‑US data transfers since 2000 illegal. Despite this, most DPAs have not acted on 101 complaints filed by noyb, with only Sweden…
European Commission · EU-U.S. Data Privacy Framework
Moderate
FRAMEWORK UPDATE
Announced
European Union · Aug 14, 2023
EU and US announce new Trans-Atlantic Data Privacy Framework amid 23 years of illegal transfers
The European Commission and the United States agreed in mid‑July 2023 on a new Trans‑Atlantic Data Privacy Framework (TADPF), a successor to the invalidated Safe Harbor and Privacy Shield. noyb reports that most EU data protection…
European Commission · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Aug 1, 2023
Meta to switch to consent for behavioral ads after EU litigation
Meta announced it will seek user consent before showing behavioral ads in the EU and Switzerland, changing its legal basis from legitimate interest to consent. The move follows litigation by noyb, decisions by the EDPB and the CJEU, and a…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Settled
Belgium · Jul 19, 2023
Belgian DPA settles with news outlets, allowing them to avoid GDPR compliance
Fifteen Belgian news sites paid €10,000 each in a settlement with the Belgian Data Protection Authority, which closed the cases without ordering changes to unlawful cookie banners. noyb filed complaints to force the DPA to reopen…
Belgian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
In effect
Norway (EEA) · Jul 17, 2023 · effective Aug 4, 2023
Norwegian DPA temporarily bans Meta’s behavioral advertising on Facebook and Instagram
The Norwegian Data Protection Authority (Datatilsynet) issued a temporary ban on Meta's use of behavioral advertising on Facebook and Instagram, effective from August 4 for at least three months. The ban remains until Meta can demonstrate…
Datatilsynet · General Data Protection Regulation
Moderate
Proposed regulation
Announced
European Union · Jul 10, 2023
EU Commission adopts third Trans-Atlantic Data Privacy Framework, likely to face CJEU challenge
The European Commission has introduced a new Trans-Atlantic Data Privacy Framework as its third attempt to secure an EU‑US data transfer adequacy decision. Privacy‑rights group noyb says it will challenge the decision before the Court of…
European Commission · EU-U.S. Data Privacy Framework
Moderate
Proposed regulation
Proposed
European Union · Jul 4, 2023
EU Commission proposes GDPR Procedures Regulation that may limit citizens' procedural rights
The European Commission has issued a proposal to create a GDPR Procedures Regulation to address cooperation gaps among DPAs. Critics say the draft strips citizens of procedural rights and gives companies extensive participation rights. The…
European Commission · General Data Protection Regulation
Moderate
Fine
In effect
Sweden · Jul 3, 2023
Swedish DPA fines Tele2 €1M and CDON €0.3M for illegal use of Google Analytics
The Swedish Data Protection Authority (IMY) issued decisions against four companies for unlawful EU‑US data transfers via Google Analytics. It imposed a fine of 12 mio SEK (≈€1 M) on Tele2 and 300 000 SEK on CDON. The authority also…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Amendment
Passed
Ireland · Jun 28, 2023
Ireland passes amendment to Data Protection Act allowing DPC to declare GDPR cases confidential
The Irish government has passed an amendment to the Data Protection Act, creating Section 26A which permits the Data Protection Commission to declare documents relating to pending GDPR procedures confidential and criminalise their…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Moderate
Amendment
Proposed
Ireland · Jun 26, 2023
Irish Parliament debates amendment to criminalise reporting on DPC procedures
A last‑minute amendment (Section 26A) was added to the Courts and Civil Law (Miscellaneous Provisions) Bill 2022 that would allow the Irish Data Protection Commissioner to declare its procedures confidential and make reporting on them a…
Irish Data Protection Commissioner · General Data Protection Regulation
Moderate
Amendment
Pending
Ireland · Jun 26, 2023
Irish government adds Section 26A to Data Protection Act, criminalising reporting on DPC procedures
A last‑minute amendment (Section 26A) was inserted into the Courts and Civil Law (Miscellaneous Provisions) Bill 2022, allowing the Irish Data Protection Commissioner to declare most of its procedures confidential. The amendment would make…
Irish Data Protection Commissioner (DPC) · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · May 23, 2023
EU Commission proposes GDPR Procedures Regulation to address enforcement delays
Noyb calls for an EU procedural regulation to fix widespread delays and procedural tricks in GDPR enforcement across member states. The European Commission has indicated interest in such a regulation and also in the upcoming EU Collective…
European Commission · General Data Protection Regulation
Moderate
Fine
Announced
Ireland · May 22, 2023
Irish DPC imposes €1.2 billion fine on Meta for EU‑US data transfers
The Irish Data Protection Commission, backed by the European Data Protection Board, ordered Meta to cease all transfers of European personal data to the United States and to return data already transferred to EU data centres. The decision…
Irish Data Protection Commission · Standard Contractual Clauses
