Low
Enforcement
Filed
Austria · Mar 18, 2021
noyb files GDPR complaint against CRIF and AZ Direct over illegal data exchange
noyb lodged a GDPR complaint on 18 March 2021 against credit scoring firm CRIF GmbH and address publisher AZ Direct for exchanging personal data without a legal basis. The complaint alleges violations of the GDPR purpose‑limitation…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Jan 22, 2021
noyb files complaint against European Parliament over US data transfers and deceptive cookie banners
noyb filed a complaint with the European Data Protection Supervisor on behalf of six MEPs alleging illegal transfers of personal data to US providers Google and Stripe and misleading cookie banners on the Parliament's COVID‑19 testing…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Moderate
Court ruling
Decided
Austria · Dec 29, 2020
Vienna Superior Court orders Facebook to pay €500 and grant full data access
The Viennese Superior Court ruled that Facebook must pay Mr. Schrems €500 in emotional damages and provide him full access to all personal data the company holds about him. The court held that Facebook does not need user consent under GDPR…
EDPB · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Oct 29, 2020
noyb reaches 3,000 subscribers for GDPRtoday newsletter
The organization noyb announced that its GDPRtoday newsletter has surpassed 3,000 subscribers within ten months. The newsletter provides English summaries of GDPR decisions from across Europe and has translated and summarized over 500…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Oct 13, 2020
noyb files GDPR complaint against Austrian address broker AZ Direct for lack of source and recipient transparency
noyb lodged a GDPR complaint with the Austrian data protection authority against AZ Direct Österreich GmbH for refusing to disclose the origin and recipients of address data. The company claimed it was too burdensome to keep precise…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Sep 25, 2020
noyb reports companies' limited responses to GDPR data‑transfer inquiries after Schrems II
The non‑profit noyb contacted 33 firms in mid‑2020 asking for details on their international data transfers under Articles 12‑15 of the GDPR, following the CJEU Schrems II ruling. Many companies either did not reply or gave only generic…
European Commission · Standard Contractual Clauses
Moderate
Enforcement
Filed
Austria · Aug 4, 2020
noyb files GDPR complaint against CRIF over arbitrary credit score
noyb.eu lodged a GDPR complaint with the Austrian Data Protection Authority against credit rating agency CRIF for assigning a credit score of 446 despite claiming no personal data was stored. The score caused an electricity supplier to…
Austrian Data Protection Authority · General Data Protection Regulation
High
Guidance
Published
European Union · Jul 24, 2020 · effective Jul 16, 2020
noyb provides step-by-step guide for EU users to stop US data transfers after Schrems II
The document outlines how data subjects can exercise GDPR rights to learn about and halt transfers of their personal data to the United States following the CJEU Schrems II judgment. It provides sample request letters for information…
European Commission · Standard Contractual Clauses
Moderate
Court ruling
Decided
Ireland · Jul 6, 2020
Irish High Court grants leave for judicial review of DPC's slow GDPR complaint procedure
The Irish High Court granted leave to noyb.eu to challenge the Data Protection Commission's handling of GDPR complaints against WhatsApp and Instagram. The DPC has taken two years to produce a first draft inquiry report, the first step of…
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Interpretation
Published
European Union · Jun 24, 2020
EDPB responds to noyb open letter on Facebook case procedural concerns
The European Data Protection Board acknowledged the issues raised by noyb regarding the Irish DPA's handling of the Facebook case and said it is working to improve consistency procedures and cooperation among supervisory authorities. No…
European Data Protection Board · General Data Protection Regulation
Moderate
Fine
In effect
France · Jun 19, 2020
French court upholds €50 million CNIL fine against Google
The French Data Protection Authority (CNIL) imposed a €50 million fine on Google for insufficient information and lack of valid consent for personalized ads. The Conseil d’État confirmed the CNIL's decision and affirmed its jurisdiction…
CNIL · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jun 15, 2020 · effective May 25, 2018
noyb files GDPR complaint against A1 Telekom Austria over denial of location and traffic data access
noyb.eu lodged a GDPR complaint against A1 Telekom Austria for refusing to provide customers with their traffic and location data. The complaint argues that A1's reliance on an old Austrian DSB decision and the Telecommunications Act…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Pending
Ireland · May 24, 2020
noyb files GDPR complaints against Facebook Group, warns of potential €2.5bn fine
Within hours of the GDPR becoming applicable on 25 May 2018, the non‑profit noyb filed three complaints against Facebook, Instagram and WhatsApp. The Irish DPC has kept the investigation confidential but may issue a fine of up to…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · May 20, 2020
noyb announces plan to file GDPR complaints over Apple Siri recordings
A former Apple employee alleges Siri records conversations without user activation. noyb says the practice may breach the GDPR and ePrivacy rules. noyb announces it will file complaints under Article 66 GDPR urgency procedure.
Irish Data Protection Commission · General Data Protection Regulation
Low
Guidance
Published
Austria · Apr 21, 2020
First European Corona contact tracing app in Austria reviewed by noyb, epicenter.works and SBA Research
The Austrian Red Cross released a contact tracing app on March 25th, which uses a hybrid central‑server and local storage model. NGOs and security researchers reviewed the app and identified privacy weaknesses, recommending a switch to a…
Moderate
Guidance
Published
European Union · Apr 2, 2020
Noyb reports video conferencing tools' privacy policies fall short of GDPR obligations
The report examined the privacy policies of six video‑conferencing services (Zoom, Webex Meetings, Meeting, Skype, Teams, Wire) and found they lack clear GDPR information, such as basic rights and recipient details. An update on…
EDPB · General Data Protection Regulation
Low
Enforcement
Announced
Austria · Mar 31, 2020
Streaming services fail GDPR transparency requirements, report finds
A joint investigation by the Austrian Chamber of Labour and noyb evaluated eight streaming platforms against GDPR transparency obligations. The study found that most services provide insufficient information on data handling, retention…
EDPB · General Data Protection Regulation
Moderate
Court ruling
Pending
Austria · Feb 26, 2020
Vienna Regional Court closes oral hearing in GDPR case against Facebook, judgment pending
The Vienna Regional Court for Civil Matters (LGfZRS) ended a nine‑hour oral hearing in a data‑protection lawsuit against Facebook. The court will issue a written judgment in the coming months and the case is expected to be appealed to…
EDPB · General Data Protection Regulation
Moderate
Guidance
Announced
European Union · Jun 5, 2019
noyb and Access Now host workshop on GDPR enforcement actions in Vienna
The workshop “One year after GDPR: Advancing rights through effective enforcement actions” was held May 8‑10, 2019 in Vienna. It gathered NGOs, public authorities and researchers to discuss practical aspects of GDPR enforcement, noting…
EDPB · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jan 18, 2019
noyb files GDPR right‑to‑access complaints against eight streaming services
noyb filed formal complaints with the Austrian Data Protection Authority on behalf of ten users, alleging violations of the GDPR right to access by eight major streaming platforms. The complaints claim that the services either failed to…
Austrian Data Protection Authority · General Data Protection Regulation
