Moderate
Data protection authority action
Decided
Ireland · Jul 16, 2025
DPC issues final decision reprimanding Children’s Health Ireland for GDPR security breaches
The Irish Data Protection Commission concluded that Children’s Health Ireland (CHI) at Tallaght University Hospital breached GDPR security and confidentiality obligations. CHI was reprimanded and ordered to bring its processing into…
Data Protection Commission (Ireland) · General Data Protection Regulation
Moderate
Data protection authority action
Filed
Austria · Jun 26, 2025
noyb files complaint against Bumble for unlawful AI Icebreakers in Austria
noyb lodged a complaint with the Austrian Data Protection Authority alleging that Bumble's AI Icebreakers process personal data without valid consent and rely on an invalid legitimate‑interest claim. The complaint cites violations of GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Jun 16, 2025
noyb warns Meta's planned WhatsApp ads may breach GDPR and DMA
noyb alleges that Meta's intention to serve ads on WhatsApp using personal data from Instagram and Facebook violates the GDPR and the EU Digital Markets Act. The organization says the proposed "Pay or Okay" model would not provide freely…
noyb · General Data Protection Regulation
Moderate
Class action
Announced
Austria · Jun 3, 2025
noyb seeks participants for potential GDPR class action against Austrian credit agency CRIF
noyb alleges that CRIF processes personal data of millions of Austrians to calculate credit scores based on age, gender and address, potentially violating the GDPR. The organization plans a scientific review and, if evidence supports it…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Germany · May 23, 2025
German Higher Regional Court denies interim injunction against Meta AI training
The Higher Regional Court of Cologne refused the interim injunction sought by Verbraucherzentrale NRW, which alleged Meta's AI training violates the GDPR by using user data without consent. The court's decision is limited to the interim…
Hamburg Data Protection Authority · General Data Protection Regulation
Moderate
Proposed regulation
Proposed
European Union · May 20, 2025
EU trilogue negotiations on GDPR procedural regulation risk undermining enforcement
The European Commission's draft procedural regulation aimed at harmonising GDPR enforcement is in its final trilogue meeting. The proposal introduces long deadlines and complex steps that could delay cases until around 2029. NGOs warn the…
European Commission · General Data Protection Regulation
Moderate
Enforcement
In effect
United States (federal) · May 15, 2025 · effective May 15, 2025
CFPB Amends Wise Consent Order, Reducing Fine to $45,000
The Consumer Financial Protection Bureau issued an amended consent order on May 15, 2025, superseding its January 30, 2025 order against Wise. The amendment requires Wise to pay a revised civil penalty of approximately $45,000 and to…
Consumer Financial Protection Bureau · Consumer Financial Protection Act
Moderate
Consent order
Amended
United States (federal) · May 15, 2025
CFPB amends Wise consent order over inaccurate fee disclosures
The Consumer Financial Protection Bureau amended its January 30, 2025 consent order with Wise, an international remittance company. The amendment resolves claims that Wise advertised inaccurate fees and failed to properly disclose exchange…
Consumer Financial Protection Bureau
Moderate
Proposed regulation
Proposed
European Union · Apr 17, 2025
EU's draft GDPR Procedural Regulation faces criticism for increasing complexity
The European Commission has introduced a draft GDPR Procedural Regulation to improve cross‑border DPA cooperation. The proposal is currently in trilogue negotiations with the European Parliament and the Council. Critics argue the draft…
European Commission · General Data Protection Regulation
Moderate
Guidance
Published
United States (federal) · Mar 31, 2025
2024 HMDA Modified LAR Data Now Available on FFIEC Platform
The Home Mortgage Disclosure Act (HMDA) Modified Loan Application Register data for 2024 have been released on the FFIEC HMDA Platform for about 4,898 filers. The loan‑level data are modified to protect consumer privacy and are now…
Consumer Financial Protection Bureau · Home Mortgage Disclosure Act
Moderate
Enforcement
Filed
Norway (EEA) · Mar 20, 2025
noyb files second GDPR complaint against OpenAI over defamatory AI hallucinations in Norway
noyb filed a second complaint with the Norwegian Data Protection Authority alleging that OpenAI's ChatGPT generated false, defamatory personal data about a Norwegian user. The complaint cites violations of GDPR Article 5(1)(d) on data…
Norwegian Datatilsynet · General Data Protection Regulation
Moderate
Court ruling
Decided
Ireland · Jan 29, 2025
EU General Court rules Irish DPC acted unlawfully for refusing to investigate noyb complaint
The EU General Court held that the Irish Data Protection Commission unlawfully refused to investigate a complaint filed by noyb. The court dismissed the DPC's claims against the European Data Protection Board. The case can now be appealed…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Executive order
Signed
United States (federal) · Jan 23, 2025
Trump signs executive order that could dismantle EU-US Transatlantic Data Privacy Framework
The US President signed an executive order stating that all Biden-era national security decisions, including those underpinning the EU‑US data transfer framework, will be reviewed and possibly revoked within 45 days. The Transatlantic Data…
European Commission · EU-U.S. Data Privacy Framework
Moderate
Enforcement
Filed
European Union · Jan 16, 2025
noyb files GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi over transfers to China
noyb has lodged six GDPR complaints in five EU countries alleging unlawful transfers of Europeans' personal data to China by TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi. The complaints request that DPAs suspend the transfers under…
European Commission · Standard Contractual Clauses
Moderate
Court ruling
Decided
Austria · Jan 9, 2025
CJEU rules Austrian DPA cannot limit data subject complaints to two per month
The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
Italy · Dec 19, 2024
noyb files GDPR complaint against Ryanair over mandatory biometric face scans
noyb has filed a complaint with the Italian Data Protection Authority alleging that Ryanair forces new customers to create permanent accounts and undergo a biometric facial‑recognition verification to book flights. The complaint says this…
Italian Data Protection Authority (Garante) · General Data Protection Regulation
Moderate
Fine
Decided
Netherlands · Dec 18, 2024
Dutch DPA fines Netflix €4.75 million for inadequate data‑subject information
The Dutch Data Protection Authority issued a decision imposing a €4.75 million fine on Netflix for not adequately informing customers about its data processing. The authority found Netflix failed to provide clear information and a full…
Dutch Data Protection Authority (Autoriteit Persoonsgegevens) · General Data Protection Regulation
Moderate
Enforcement
Decided
European Union · Dec 13, 2024
EDPS finds European Commission illegally used political micro‑targeting
The European Data Protection Supervisor issued a decision that the European Commission illegally targeted ads using sensitive political data. The EDPS issued only a reprimand, noting no fine was needed as the practice stopped. The decision…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Interpretation
In effect
European Union · Dec 2, 2024 · effective Dec 2, 2024
noyb qualified as EU 'Qualified Entity' to bring collective GDPR redress actions
noyb has been approved as a Qualified Entity under Directive (EU) 2020/1828, allowing it to bring collective injunctions and redress actions across the EU. Approvals were issued by Austria's Bundeskartellamt on 2 December 2024 and…
Bundeskartellamt; Irish Ministry for Justice · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Oct 4, 2024
CJEU rules Meta must minimise use of personal data for ads
The Court of Justice of the European Union (CJEU) held that Meta must limit the processing of personal data for online advertising to what is strictly necessary, applying the GDPR data‑minimisation principle regardless of consent. It also…
EDPB · General Data Protection Regulation
