Moderate
Enforcement
Filed
European Union · Jan 22, 2021
noyb files complaint against European Parliament over US data transfers and deceptive cookie banners
noyb filed a complaint with the European Data Protection Supervisor on behalf of six MEPs alleging illegal transfers of personal data to US providers Google and Stripe and misleading cookie banners on the Parliament's COVID‑19 testing…
European Data Protection Supervisor (EDPS) · General Data Protection Regulation
Low
Settlement
Settled
Ireland · Jan 13, 2021
Irish DPC settles judicial review, pledges swift decision on Facebook EU‑US data transfers
The Irish Data Protection Commission (DPC) settled a judicial review with Max Schrems and agreed to decide quickly on Facebook's EU‑US data flows. The settlement allows Schrems to be heard in the DPC's own‑volition procedure and to access…
Irish Data Protection Commission · General Data Protection Regulation
Low
Enforcement
Filed
Germany · Nov 16, 2020
noyb files complaints against Apple's IDFA tracking code
The privacy NGO noyb filed two complaints with the German and Spanish data protection authorities alleging that Apple's Identifier for Advertisers (IDFA) tracks users without consent, violating the EU e‑Privacy Directive. The complaints…
EDPB · General Data Protection Regulation
Moderate
Enforcement
Filed
Malta · Nov 12, 2020
noyb files complaint with Maltese DPA over C-Planet voter data breach
noyb filed a complaint with the Maltese Data Protection Authority against C-Planet IT Solutions for leaking personal data of 337,384 voters, including phone numbers, dates of birth and political opinions. NGOs Daphne Foundation and…
Maltese Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · Oct 21, 2020
noyb files GDPR complaint against Wizz Air over charged rectification request
On 21.10.2020 noyb filed a GDPR complaint with the Austrian Data Protection Authority against Wizz Air for charging €35 to update a passenger's surname. The airline required the passenger to call a paid hotline to make the change…
Austrian Data Protection Authority · General Data Protection Regulation
Moderate
Enforcement
Announced
European Union · Sep 25, 2020
noyb reports companies' limited responses to GDPR data‑transfer inquiries after Schrems II
The non‑profit noyb contacted 33 firms in mid‑2020 asking for details on their international data transfers under Articles 12‑15 of the GDPR, following the CJEU Schrems II ruling. Many companies either did not reply or gave only generic…
European Commission · Standard Contractual Clauses
Moderate
Enforcement
Filed
European Union · Sep 22, 2020
noyb files 101 complaints against EU website operators for illegal US data transfers
noyb lodged 101 complaints against EU/EEA website operators using Google Analytics and Facebook Connect, alleging illegal transfers of personal data to the US. The complaints rely on the CJEU judgment of 16 July 2020 that such transfers…
EDPB · General Data Protection Regulation
Low
Enforcement
Decided
Austria · Sep 16, 2020
Austrian DSB decides on Flimmit streaming complaint after 1.5 years
In September 2020 the Austrian Data Protection Authority (DSB) issued a decision on the complaint against Vienna streaming service Flimmit filed by noyb. The DSB rejected the complaint because Flimmit provided the missing information about…
Datenschutzbehörde (DSB) · General Data Protection Regulation
Moderate
Enforcement
Filed
European Union · Aug 17, 2020
101 GDPR complaints filed against EU companies for US data transfers to Google and Facebook
Noyb has filed 101 complaints in all 30 EU and EEA member states alleging that European companies continue to forward visitor data to Google and Facebook in the US. The complaints cite the CJEU ruling that the EU‑US Privacy Shield is…
Data Protection Authorities · Standard Contractual Clauses
Moderate
Enforcement
Filed
Austria · Aug 4, 2020
noyb files GDPR complaint against CRIF over arbitrary credit score
noyb.eu lodged a GDPR complaint with the Austrian Data Protection Authority against credit rating agency CRIF for assigning a credit score of 446 despite claiming no personal data was stored. The score caused an electricity supplier to…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Pending
Ireland · Jul 28, 2020 · deadline Jul 31, 2020
Irish DPC provides no clear timeline for enforcing CJEU data transfer judgment
noyb requested the Irish Data Protection Commission (DPC) to act on the CJEU judgment invalidating the EU‑US data transfer mechanisms. The DPC replied that it will not commit to a clear timetable for a decision. noyb set a compliance…
Irish Data Protection Commission · Standard Contractual Clauses
Low
Enforcement
Filed
Austria · Jun 15, 2020 · effective May 25, 2018
noyb files GDPR complaint against A1 Telekom Austria over denial of location and traffic data access
noyb.eu lodged a GDPR complaint against A1 Telekom Austria for refusing to provide customers with their traffic and location data. The complaint argues that A1's reliance on an old Austrian DSB decision and the Telecommunications Act…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Enforcement
Announced
Ireland · May 20, 2020
noyb announces plan to file GDPR complaints over Apple Siri recordings
A former Apple employee alleges Siri records conversations without user activation. noyb says the practice may breach the GDPR and ePrivacy rules. noyb announces it will file complaints under Article 66 GDPR urgency procedure.
Irish Data Protection Commission · General Data Protection Regulation
Moderate
Enforcement
Filed
Austria · May 13, 2020
noyb files GDPR complaint against Google over Android Advertising ID tracking
noyb filed a formal GDPR complaint against Google for tracking users via the Android Advertising ID without a valid legal basis. The complaint was submitted on behalf of an Austrian citizen to the Austrian Data Protection Authority. GDPR…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Announced
Austria · Mar 31, 2020
Streaming services fail GDPR transparency requirements, report finds
A joint investigation by the Austrian Chamber of Labour and noyb evaluated eight streaming platforms against GDPR transparency obligations. The study found that most services provide insufficient information on data handling, retention…
EDPB · General Data Protection Regulation
Low
Investigation
Filed
DE-HE · Mar 2, 2020
noyb files GDPR complaint against Amazon for lacking TLS email encryption
The privacy NGO noyb submitted a complaint to the Hessian Data Protection Authority alleging Amazon violates GDPR Article 32 by not using TLS encryption for emails. The complaint may also be handled by Luxembourg's DPA, which could impose…
Hessian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Filed
Norway (EEA) · Jan 14, 2020
Norwegian DPA receives GDPR complaints against Grindr and ad‑tech firms
The Norwegian Consumer Council, together with noyb, filed three formal GDPR complaints against Grindr and five ad‑tech companies (Twitter’s MoPub, AT&T’s AppNexus, OpenX, AdColony, Smaato) with the Norwegian Data Protection Authority. The…
Norwegian Data Protection Authority · General Data Protection Regulation
Moderate
Fine
Announced
France · Jun 21, 2019
CNIL fines Google €50 million for GDPR ‘forced consent’ violations
The French data protection authority (CNIL) announced a €50 million fine against Google for GDPR violations related to forced consent. The penalty stems from complaints filed by noyb.eu and La Quadrature du Net. The announcement was made…
CNIL · General Data Protection Regulation
Low
Enforcement
Filed
Austria · Jan 18, 2019
noyb files GDPR right‑to‑access complaints against eight streaming services
noyb filed formal complaints with the Austrian Data Protection Authority on behalf of ten users, alleging violations of the GDPR right to access by eight major streaming platforms. The complaints claim that the services either failed to…
Austrian Data Protection Authority · General Data Protection Regulation
Low
Enforcement
Published
Austria · Dec 10, 2018
Austrian DSB decision on DerStandard.at ‘pay or okay’ subscription model
The Austrian Data Protection Authority (DSB) ruled that DerStandard.at’s subscription option requiring users to pay €6 per month for privacy instead of giving free consent is not voluntary under the GDPR. The decision sparked criticism…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
