Low
Enforcement
Pending
Ireland · Dec 19, 2021
Facebook ignores EU Court rulings on data transfers, Irish DPC enforcement pending
noyb reports that Facebook's 86‑page Transfer Impact Assessment disregards the CJEU Schrems I and II rulings that require EU‑US data transfers to stop. The Irish Data Protection Commission has not yet issued a decision despite a complaint…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Fine
In effect
Norway (EEA) · Dec 15, 2021 · effective Dec 15, 2021
Norwegian DPA fines Grindr €6.3 M for illegal sharing of sensitive data
The Norwegian Data Protection Authority imposed a fine of 65 Mio NOK on Grindr for sharing sensitive personal data without valid consent. The authority found the consent mechanism invalid and highlighted the lack of a genuine opt‑out. The…
Norwegian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · Dec 12, 2021
Irish DPC sends threat letters to noyb over Facebook ROPA publication
noyb published Facebook's four‑page Record of Processing Activities (ROPA) required by Article 30 GDPR. The Irish Data Protection Commission, which received the ROPA on 27.9.2018, sent angry letters to noyb demanding the removal of the…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Announced
Germany · Dec 10, 2021
noyb and ZDF Magazin Royale seek data donors to enforce GDPR micro‑targeting ban
noyb and ZDF Magazin Royale are asking users of the "Who Targets Me" browser extension from the 2021 German federal election to donate their data. The aim is to find a case to enforce the GDPR prohibition on political micro‑targeting under…
EDPB · General Data Protection Regulation
Moderate
Guidance
Published
Ireland · Dec 4, 2021
Irish DPC tried to embed Facebook consent bypass into EDPB Guidelines, but final 2019 guidelines omitted it
A letter shows the Irish DPC held ten meetings with Facebook and agreed on a GDPR bypass by moving consent into terms and conditions. The DPC then drafted EDPB guideline language to allow this approach, but other DPAs criticised it…
Irish Data Protection Commission (DPC) · General Data Protection Regulation
Low
Enforcement
Announced
Austria · Nov 28, 2021
Austrian DPA rejects Facebook's confidentiality claim in GDPR data‑transfer dispute
The Austrian Data Protection Authority (DSB) rejected Facebook's claim that certain documents were confidential, providing all documents to the Irish DPC. The DSB also reminded Facebook that official Austrian procedures must be conducted…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
In effect
Ireland · Nov 23, 2021 · effective Nov 18, 2021
Irish DPC removes noyb from GDPR procedure after demanding NDA
The Irish Data Protection Commission (DPC) demanded that privacy activist group noyb sign a non‑disclosure agreement to continue hearing its complaint against Facebook. After noyb refused, the DPC removed the organization from the GDPR…
Irish Data Protection Commission · General Data Protection Regulation
Low
Appeal
Filed
Austria · Nov 15, 2021
noyb appeals Austrian DPA decision on cell‑phone location and traffic data to Federal Administrative Court
noyb filed a notice of appeal with Austria's Federal Administrative Court against the DSB's decision that A1 may refuse to provide location and traffic data to a user. The DSB argued the data are not personal because a third party could…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Nov 11, 2021
noyb files GDPR complaint against Grindr over selfie ID requirement
noyb lodged a GDPR complaint with the Austrian Data Protection Authority alleging that Grindr's policy of requiring a selfie with a passport and email paper violates data minimisation and the right of access. The complainant was denied…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Filed
Luxembourg · Oct 21, 2021
noyb files GDPR complaint against Amazon Europe over opaque automated payment decisions
noyb lodged a complaint with Luxembourg's data protection authority alleging that Amazon Europe's automated "Monthly Invoice" payment rejections violate GDPR transparency and access requirements. The complaint cites the lack of explanation…
Luxembourg National Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Oct 18, 2021
noyb files GDPR complaint against Acxiom and CRIF Bürgel over illegal credit scores
noyb lodged a complaint in Germany alleging that address trader Acxiom and credit reference agency CRIF Bürgel illegally use personal data to calculate credit scores without consent, violating the GDPR and the German Federal Data…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Announced
Ireland · Oct 15, 2021
Irish DPC orders noyb to remove draft decision from website
The Irish Data Protection Commission sent a take‑down request to privacy activist group noyb on 14 Oct 2021, ordering removal of a draft decision that allegedly strips Facebook users of GDPR rights. noyb refused, citing Austrian law and…
Irish Data Protection Commission · General Data Protection Regulation
Low
Guidance
Published
European Union · Sep 2, 2021
noyb hires GDPR lawyers and full stack developers
noyb announced job openings for GDPR lawyers and full stack developers. The announcement invites referrals and directs interested candidates to the job page. It seeks to expand the team to handle its workload.
EDPB · General Data Protection Regulation
Moderate
Fine
Announced
Ireland · Sep 2, 2021
Irish DPC issues €225 million fine against WhatsApp
The Irish Data Protection Commission imposed a €225 million fine on WhatsApp (owned by Facebook) under the GDPR. The fine was increased from an initial €50 million after pressure from other EU data protection authorities. Max Schrems of…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 13, 2021
noyb files complaints against cookie paywalls of seven German and Austrian news sites over unlawful consent
noyb filed complaints against the cookie paywalls of SPIEGEL.de, Zeit.de, heise.de, FAZ.net, derStandard.at, krone.at and t-online.de, arguing that the "pay or okay" model violates the GDPR's requirement for freely given consent. The…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 10, 2021
noyb files 422 GDPR complaints over deceptive cookie banners
noyb filed 422 formal GDPR complaints with data protection authorities in ten EU countries concerning dark‑pattern cookie banners. After a warning phase, 42% of identified violations were remedied, but 82% of the 516 sites still breach the…
Data Protection Authorities · General Data Protection Regulation
Low
Enforcement
Decided
Austria · Aug 4, 2021
Austrian DPA orders credit agency CRIF to disclose scoring logic after GDPR complaint
The Austrian Data Protection Authority ruled that CRIF's credit assessment constitutes profiling under the GDPR and must disclose that the creditworthiness score was calculated only from address, gender, name and date of birth. CRIF must…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jul 20, 2021
Austrian Supreme Court refers Facebook case to CJEU over consent vs contract and awards €500 symbolic damages
The Austrian Supreme Court (OGH) referred four questions to the Court of Justice of the EU concerning Facebook's reliance on contract instead of consent under the GDPR. In a partial judgment, the court awarded Max Schrems €500 for lack of…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Pending
European Union · Jul 19, 2021
noyb reports 2.5‑year delay in GDPR access‑request complaints against streaming services
In January 2019 noyb filed complaints against eight streaming services for failing to comply with the GDPR right of access. After two and a half years only one complaint was resolved after noyb took the responsible authority to court. The…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jul 16, 2021
Anniversary of the CJEU 'Schrems II' decision on EU‑US data transfers
Max Schrems marks one year since the CJEU's Schrems II ruling that declared EU‑US data transfers unlawful. He notes a lack of clear guidance, pending model complaints filed by noyb, and ongoing uncertainty around Standard Contractual…
European Data Protection Board · General Data Protection Regulation
