Low
Lawsuit filed
Filed
United States (federal) · Sep 18, 2026
EPIC sues Trump administration over State Citizenship Lists program
EPIC, together with Protect Democracy and CREW, filed a lawsuit on Sept. 1, 2026 challenging DHS, SSA, and the State Department’s plan to create and distribute State Citizenship Lists for voter eligibility. The suit argues the program is…
Moderate
Court ruling
Decided
United States (federal) · Jun 29, 2026
US Supreme Court decision undermines EU‑US Data Privacy Framework
The US Supreme Court ruled in Trump v. Slaughter that the FTC cannot be an independent agency. The decision calls into question the independence requirement for the EU‑US Data Privacy Framework, effectively collapsing the adequacy…
EDPB · General Data Protection Regulation
Low
Court ruling
Decided
European Union · Sep 3, 2025
EU General Court rejects Latombe challenge to EU‑US data transfer framework
French MP Philippe Latombe filed an action for annulment of the Transatlantic Data Protection Framework before the EU General Court. The General Court dismissed the narrow challenge, finding it unconvincing. The decision leaves the…
Transatlantic Data Protection Framework
Moderate
Court ruling
Decided
Austria · Jan 9, 2025
CJEU rules Austrian DPA cannot limit data subject complaints to two per month
The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR…
Austrian Data Protection Authority (DSB) · General Data Protection Regulation
Low
Appeal
Filed
Sweden · Aug 12, 2024
noyb appeals to Swedish court over IMY's refusal to investigate data subject complaints
noyb has filed an appeal with the Kammarrätten i Stockholm challenging the Swedish Data Protection Authority's practice of forwarding complaints without investigation. The appeal follows a Supreme Administrative Court ruling that…
Swedish Data Protection Authority (IMY) · General Data Protection Regulation
Moderate
Court ruling
Decided
European Union · Jun 24, 2021
European Court of Justice invalidated Privacy Shield in July 2020
The European Court of Justice ruled that the EU‑US Privacy Shield framework is invalid, affecting cross‑border data transfers. The decision was highlighted in noyb’s 2020 Annual Report.
Privacy Shield
Moderate
Court ruling
Decided
Ireland · Oct 12, 2020
Irish High Court grants judicial review to stop Facebook EU-US data transfers
The Irish High Court granted leave for a judicial review filed by privacy group noyb against the Irish Data Protection Commission (DPC) to compel a decision on Facebook's EU‑US data transfers. The action seeks to enforce the European Court…
Irish Data Protection Commission · Standard Contractual Clauses
Moderate
Court ruling
Announced
Ireland · Sep 14, 2020
Irish High Court grants Facebook leave to file Judicial Review, stays DPC EU‑US data‑flow investigation
The Irish High Court granted Facebook leave to bring a Judicial Review (Case No 2020/617 JR) and ordered a stay of the Data Protection Commission's ex officio investigation into Facebook's EU‑US data transfers. The DPC may resume the…
Data Protection Commission (DPC) · Standard Contractual Clauses
Moderate
Court ruling
Decided
European Union · Jul 12, 2020
CJEU judgment limits EU‑US data outsourcing, confirms 'necessary' transfers exempt
The Court of Justice of the EU ruled that "necessary" transfers of personal data to the US are not affected by the case, while voluntary outsourcing of processing to US providers may violate the GDPR. The judgment confirms the invalidity…
European Commission · Standard Contractual Clauses
Low
Lawsuit filed
Filed
Ireland · Dec 18, 2019
Irish DPC files lawsuit against Facebook and Max Schrems over validity of SCCs
The Irish Data Protection Commissioner filed a lawsuit against Facebook and Max Schrems in the Irish High Court to refer the dispute on Standard Contractual Clauses to the CJEU. The case concerns whether SCCs can be used when US…
Irish Data Protection Commissioner · Standard Contractual Clauses
Low
Court ruling
Announced
Ireland · Sep 17, 2019
CJEU to hear Schrems‑Facebook case on EU‑US data transfers under SCCs and Privacy Shield
The Court of Justice of the European Union (Grand Chamber) will hear case C‑311/18 on July 9 2019 concerning EU‑US data transfers to Facebook under Standard Contractual Clauses and the Privacy Shield, focusing on US mass surveillance. The…
Irish Data Protection Commissioner · Standard Contractual Clauses
