Moderate
Data protection authority action
Announced
Malta · May 17, 2023
Maltese DPA orders C-PLANET to disclose data source within 20 days or face fine
The Maltese Data Protection Authority (IDPC) ordered IT company C-PLANET to provide details on the source of personal data collected on voters within 20 days. Failure to comply will result in a proportionate and dissuasive fine under the…
Maltese Data Protection Authority (IDPC) · General Data Protection Regulation
Moderate
Data protection authority action
Decided
Austria · May 10, 2023
Austrian DPA deems Clearview AI’s biometric data processing illegal, orders deletion, no fine
The Austrian Data Protection Authority ruled that Clearview AI may not process the complainant’s biometric data and must delete the data. The decision cites GDPR violations for scraping and selling personal data of Europeans. No monetary…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · May 4, 2023
CJEU rules GDPR right of access must include documents and database extracts
The Court of Justice of the European Union held that a data subject’s right of access under Article 15 GDPR includes providing the data in context, such as relevant documents and database extracts. The ruling arose from a complaint against…
EDPB · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Apr 4, 2023
noyb launches free tool for broad Facebook opt‑out under GDPR
The privacy NGO noyb released an online tool that lets users submit a broad objection to Meta’s processing of personal data for targeted advertising, which Meta bases on “legitimate interest”. The tool simplifies the GDPR right to object…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Mar 17, 2023
Austrian Federal Administrative Court allows mobile providers to refuse access requests for location data without proof of exclusive use
The Austrian Federal Administrative Court (BVwG) ruled that A1 Telekom Austria may deny a data subject's request for traffic and location data unless the subject can prove exclusive use of the phone. The court deemed location data…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Feb 28, 2023
noyb files complaints against data brokers for refusing cookie‑based authentication of GDPR access requests
noyb lodged a series of complaints against websites and data brokers that denied or complicated GDPR access requests by requiring additional identification beyond cookies. The complaints argue that, under GDPR and EDPB guidance, users…
EDPB · General Data Protection Regulation
Moderate
Fine
Announced
Ireland · Jan 27, 2023
Irish DPC announces €390 million fine on Meta for GDPR consent breach
The Irish Data Protection Commission announced a €390 million fine against Meta, ordering it to obtain valid consent for personalized advertising after the European Data Protection Board issued a binding decision. The fine illustrates…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Dec 6, 2022
EU Data Protection Board rules Meta's consent bypass for personalized ads illegal
The European Data Protection Board (EDPB) decided that Meta cannot force users to accept personalized ads and must obtain a yes/no consent option. The decision overturns a previous draft decision by the Irish Data Protection Commission and…
European Data Protection Board (EDPB) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Oct 27, 2022
noyb files 700+ GDPR complaints on cookie banners, prompting widespread addition of reject buttons
noyb scanned over 3,600 websites in March 2021 and filed more than 700 complaints across Europe for GDPR‑violating cookie banners lacking a clear reject option. Follow‑up scans in October 2022 showed that 41% of the sites added a reject…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Published
European Union · Oct 13, 2022
CJEU Advocate General opinion may limit GDPR non‑material damages compensation
The Advocate General of the Court of Justice of the EU issued an opinion that could restrict the right to claim non‑material damages under the GDPR. The opinion questions whether Article 82 allows damages without material loss and suggests…
EDPB · General Data Protection Regulation
Moderate
Executive order
Signed
United States (federal) · Oct 7, 2022
US President Biden signs Executive Order on surveillance, unlikely to satisfy EU law
President Joe Biden signed a new Executive Order intended to address EU concerns over US surveillance practices. The order retains bulk surveillance and creates a non‑judicial “Data Protection Review Court,” which the source says does not…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 9, 2022
226 GDPR complaints lodged against deceptive OneTrust cookie banners
noyb filed 226 complaints with 18 data protection authorities over websites using OneTrust cookie banners that employ deceptive designs. The complaints allege violations of GDPR requirements for a fair yes/no consent choice. Some websites…
EDPB · General Data Protection Regulation
Moderate
Fine
Decided
European Union · Jul 21, 2022
6.3 million Euro fine imposed on Grindr for GDPR violations
noyb’s complaints resulted in a 6.3 million Euro fine against the gay dating app Grindr for breaching the GDPR. The fine was highlighted in noyb’s 2021 Annual Report.
EDPB · General Data Protection Regulation
Moderate
Data protection authority action
Published
Ireland · Jul 7, 2022
Irish DPC issues Draft Decision on Facebook EU-US data transfers, starts one-month comment period
The Irish Data Protection Commission issued a Draft Decision under Article 60 GDPR concerning Meta's Facebook EU‑US data transfers. The draft triggers a one‑month comment period for other European DPAs and does not immediately halt the…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
In effect
European Union · Jul 5, 2022
EU DPAs ban use of Google Analytics over unlawful US data transfers
The Italian Data Protection Authority (GPDP) declared Google Analytics illegal because it transfers personal data to the United States. French CNIL and Austrian DPA issued similar orders, requiring websites to stop using the service. The…
Italian Data Protection Authority (GPDP) · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · May 24, 2022
noyb warns of widespread GDPR non‑compliance and lack of enforcement after four years
The NGO noyb states that despite the GDPR becoming applicable on 25 May 2018, many companies continue to ignore users' rights and enforcement remains weak. It notes that about 50 cross‑country cases it filed have not yet received a final…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Announced
European Union · May 22, 2022
Open Letter warns EU‑US data transfer deal lacks material US law changes
The open letter published on 2022‑05‑22 criticises the announced Trans‑Atlantic Data Privacy Framework for relying on US executive orders without substantive changes to US surveillance law. It argues that the framework repeats the…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
Austria · May 2, 2022
Austrian DPA rejects risk‑based approach for EU‑US data transfers, deems Google IP anonymisation insufficient
The Austrian Data Protection Authority issued a decision stating that the GDPR does not permit a risk‑based approach for transfers to insecure third countries such as the United States. It also concluded that Google’s IP anonymisation does…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Data protection authority action
In effect
France · Apr 5, 2022
CNIL rules use of Google Analytics illegal and orders French sites to comply with GDPR
The French data protection authority (CNIL) decided that using Google Analytics violates the GDPR and ordered three French website controllers to bring their practices into compliance. The decision follows earlier Austrian DPA rulings and…
CNIL · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Mar 4, 2022
noyb launches second wave of GDPR complaints against deceptive cookie banners
noyb sent 270 draft complaints to website operators whose cookie banners violate the GDPR, offering a 60‑day grace period before filing formal complaints. If companies do not fully comply, noyb will file complaints with DPAs, which may…
Data Protection Authorities · General Data Protection Regulation
