Moderate
Court ruling
Decided
European Union · Jul 12, 2020
CJEU judgment limits EU‑US data outsourcing, confirms 'necessary' transfers exempt
The Court of Justice of the EU ruled that "necessary" transfers of personal data to the US are not affected by the case, while voluntary outsourcing of processing to US providers may violate the GDPR. The judgment confirms the invalidity…
European Commission · Standard Contractual Clauses
Moderate
Court ruling
Decided
Ireland · Jul 6, 2020
Irish High Court grants leave for judicial review of DPC's slow GDPR complaint procedure
The Irish High Court granted leave to noyb.eu to challenge the Data Protection Commission's handling of GDPR complaints against WhatsApp and Instagram. The DPC has taken two years to produce a first draft inquiry report, the first step of…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Jun 30, 2020
Vienna Regional Court issues limited judgment in Schrems v. Facebook case
The Vienna Regional Court delivered a written judgment that largely summarised the facts and granted the plaintiff full access to his data and €500 symbolic damages. The judge limited legal analysis of GDPR compliance to 19 sentences and…
EDPB · General Data Protection Regulation
Low
Class action
Announced
Malta · May 27, 2020
Massive political data leak in Malta prompts class action
A database of 337,384 Maltese voters' personal information, including political affiliation, was publicly accessible for at least a year after being stored by C‑Planet IT Solutions in an open directory. The leak violates GDPR provisions on…
Maltese Data Protection Authority · General Data Protection Regulation
Moderate
Court ruling
Pending
Austria · Feb 26, 2020
Vienna Regional Court closes oral hearing in GDPR case against Facebook, judgment pending
The Vienna Regional Court for Civil Matters (LGfZRS) ended a nine‑hour oral hearing in a data‑protection lawsuit against Facebook. The court will issue a written judgment in the coming months and the case is expected to be appealed to…
EDPB · General Data Protection Regulation
Low
Lawsuit filed
Filed
Ireland · Dec 18, 2019
Irish DPC files lawsuit against Facebook and Max Schrems over validity of SCCs
The Irish Data Protection Commissioner filed a lawsuit against Facebook and Max Schrems in the Irish High Court to refer the dispute on Standard Contractual Clauses to the CJEU. The case concerns whether SCCs can be used when US…
Irish Data Protection Commissioner · Standard Contractual Clauses
Low
Lawsuit filed
Pending
Austria · Nov 12, 2019
Austrian court hears case accusing Facebook of processing data without consent under GDPR
In proceedings before the Vienna Regional Court, Facebook admitted to collecting and processing user data without consent since the GDPR took effect on May 25, 2018. The plaintiff argues that Facebook cannot rely on an alleged advertising…
EDPB · General Data Protection Regulation
Low
Court ruling
Announced
Ireland · Sep 17, 2019
CJEU to hear Schrems‑Facebook case on EU‑US data transfers under SCCs and Privacy Shield
The Court of Justice of the European Union (Grand Chamber) will hear case C‑311/18 on July 9 2019 concerning EU‑US data transfers to Facebook under Standard Contractual Clauses and the Privacy Shield, focusing on US mass surveillance. The…
Irish Data Protection Commissioner · Standard Contractual Clauses
Low
Court ruling
Decided
Austria · Jun 21, 2019
Austrian Supreme Court rejects Facebook's attempt to block GDPR model lawsuit
The Austrian Supreme Court dismissed all of Facebook's efforts to halt a model privacy lawsuit, confirming that any party may bring a claim under the GDPR. The court also ruled that national variations of the GDPR can no longer restrict…
EDPB · General Data Protection Regulation
Low
Court ruling
Decided
Ireland · May 31, 2019
Irish Supreme Court dismisses Facebook’s application to halt EU‑US data‑transfer reference
The Irish Supreme Court dismissed Facebook’s application, finding it had jurisdiction to intervene but the company failed to substantiate its request. The court therefore did not take the actions sought by Facebook, allowing the case to…
Irish Data Protection Commission · Safe Harbor
Low
Court ruling
Pending
Austria · Oct 16, 2018
Austrian bank appeals DPA decision on GDPR access fee
The Austrian Data Protection Authority ruled that a customer must be granted access to his bank account details under the GDPR. The bank appealed, arguing that banking regulations permit a €30 annual fee for information not available…
Austrian Data Protection Authority · General Data Protection Regulation
