News

Procurement dispute: estoppel allowed

> Procurement. Claim for damages against contracting authority. Reliance on estoppel succeeds. Plaintiff did not challenge the award decision in interlocutory proceedings within…

"A court in the northern part of the Netherlands has ruled in a case in which the defendant is being required to disclose the source code and pay a usage fee." ⇄

Request for Release of Source Code. Usage Fees. Unlawful Removal of Source Code?

"North Netherlands court rules on claim to release source code and use fee"

> Claim for release of source code. Use fee. Unlawful removal of source code? (Machine translated)

Statement by the authors of the article "Stochastic Parrots" regarding the letter advocating for a "pause in AI development". ⇄

The harmful consequences of so-called artificial intelligence are real and current, and are the result of the actions of individuals and companies deploying automated systems.…

Statement from the listed authors of Stochastic Parrots on the “AI pause” letter

> The harms from so-called AI are real and present and follow from the acts of people and corporations deploying automated systems. Regulatory efforts should focus on…

"Amsterdam Court of Appeal: Dissolution of the company due to a disrupted working relationship and justified complaints regarding privacy violations." ⇄

Termination of employment due to a disrupted working relationship, serious fault on the part of the employer resulting from insufficient support during the first attempt at…

"Amsterdam Court of Appeal: Dissolution due to disrupted employment relationship and justified complaints of privacy violations"

> Dissolution because of a disturbed employment relationship, serious culpability of the employer because of insufficient reintegration in the first track and justified complaints…

"The District Court of Overijssel dismisses the municipality's appeal in the case regarding the cyberattack." ⇄

On December 1, 2020, a cyberattack occurred at the municipality, during which the municipality's network and backup systems were encrypted and rendered inaccessible, and many…

"Overijssel court rejects municipality's claim in cyber attack case"

> On December 1, 2020, a cyber attack took place at the municipality, encrypting and making inaccessible the municipality's network and backup systems and deleting many virtual…

Clearview AI data use deemed illegal in Austria, however no fine issued

The Austrian data protection authority has decided: Clearview AI, the company that sells facial recognition software to law enforcement agencies in the U.S. is no longer allowed…

Facial Recognition: the CNIL has decided to impose a fine on Clearview AI. ⇄

Background information CLEARVIEW AI collects photos from a wide range of websites, including social networks, and sells access to its database of images of individuals via a…

The Court of Justice confirmed that there is no "threshold" for GDPR damages

, contrary to national courts. Today, the Court of Justice of the European Union (CJEU) issued the first judgment on emotional damages under the GDPR, confirming that the GDPR…

noyb win at CJEU: Right of access may include documents and database extracts

noyb wins at the CJEU: Right to information must include context - in some cases also documents and database excerpts Yesterday, the Court of Justice of the European Union (CJEU)…

Legal ruling: Surveillance at Tata Steel is not illegal, and it is unlikely that employees' privacy is being violated. ⇄

Camera surveillance of harmful emissions at Tata Steel’s processing plant is not illegal. The surveillance in question is effective and not targeted at individuals. The likelihood…

Legal ruling: Surveillance at Tata Steel not unlawful, privacy of employees unlikely to be breached.

Camera surveillance of harmful emissions at Tata Steel's cooking plant is not unlawful. Spoken of effective surveillance that is not directed at individuals. Very low likelihood…

The Dutch Court of Justice has rendered a judgment regarding the public nature of civil proceedings. ⇄

Cassation in the interest of the law. Public nature of civil proceedings. Are courts obliged to provide third parties with information regarding civil proceedings that are ongoing…

Dutch Supreme Court Rules on Public Access to Civil Proceedings

Cassation in the interest of the law. Disclosure of civil proceedings. Are courts required to disclose to others than parties information about civil proceedings that are or have…

Can organizations improve efficiency by combining the roles of Data Protection Officer (DPO) and whistleblower? ⇄

Following the implementation of the EU Whistleblower Directive in 2021, companies’ data protection officers were tasked with establishing secure reporting channels. Since these…

Can organizations realize efficiencies by combining DPO and whistleblower roles?

> Following the implementation of the EU Whistleblower Directive in 2021, companies' data protection officers were tasked with setting up secure reporting channels. As these data…

EOKM is seeking a summary proceeding to shut down a pornographic website. ⇄

Judgment drafted by: Diederik Stols, Hanna van Til, and Otto Volgenant, Boekx Advocaten. Amsterdam District Court, April 12, 2023, IEF 21357; ECLI:NL:RBAMS:2023:2192 (EOKM v.…

EOKM seeks injunction against porn website

Judgment submitted by: Diederik Stols, Hanna van Til, and Otto Volgenant, Boekx AdvocatenRb. Amsterdam April 12, 2023, IEF 21357; ECLI:NL:RBAMS:2023:2192 (EOKM v. Hammy Media) The…

The court determines that consent is required from identifiable persons in non-professional pornographic content. ⇄

Pornographic websites must demonstrate that persons who are identifiable in images that have not been professionally produced have given their consent for the disclosure of their…

Court mandates consent for recognizable individuals in non-professional pornographic content

Porn website must be able to prove that individuals who are recognizable in images in non-professionally created footage have given their consent to disclosure.

"Pay or Okay" - the beginning of the end?

Cookie Banners "Pay or Okay" - the beginning of the end? "PUR Abo" on derStandard.at illegal according to Austrian DPA After the GDPR came into force, the Austrian daily newspaper…

Court of Justice of the EU: National regulations designed to protect employees must comply with Article 88 of the GDPR. ⇄

ECJ EU, March 30, 2023, IT 4246; ECLI:EU:C:2023:270 (Main Staff Council of Teachers at the Hessian Ministry of Education v. Minister of the Hessian Ministry of Education). The…

CJEU: National employee protection schemes must comply with Article 88 AVG

ECJ EU March 30, 2023, IT 4246; ECLI:EU:C:2023:270 (Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v. Minister des Hessischen Kultusministeriums)…

Drivers' Request for Personal Data Access and Automated Decision-Making Information from Ola Netherlands BV: Balancing Personal Data Protection with the Needs of Drivers

Request by drivers to Ola Netherlands BV for access as referred to in Article 15 (1) AVG to certain personal data concerning them (including "ratings" given by passengers) and for…

Uber drivers request access to personal data and transparency regarding automated decision-making: a balance between privacy and passenger safety. ⇄

Request by Uber drivers to Uber for access to certain personal data relating to them (including "ratings" provided by passengers), as referred to in Article 15(1) GDPR, and for…

Uber Drivers Request Access to Personal Data and Disclosure of Automated Decision-Making: Balancing Privacy with Passenger Safety

Request from Uber drivers to Uber for access as referred to in Article 15 (1) AVG to certain personal data concerning them (including "ratings" given by passengers) and for…

The Amsterdam court has received a request regarding the General Data Protection Regulation (GDPR), seeking information on the use of automated decision-making at Uber. ⇄

Request from Uber drivers to Uber for information pursuant to Article 15(1)(h) GDPR (information on the existence of automated decision-making within the meaning of Article 22…

The Netherlands Court of Audit points out obstacles to the implementation of the GDPR in the Netherlands in a letter to the House of Representatives. ⇄

The Netherlands Court of Audit has sent a letter to the House of Representatives highlighting bottlenecks in the implementation of the General Data Protection Regulation (GDPR) in…

Court of Audit points out obstacles in implementation of GDPR in Netherlands in letter to Chamber

The Court of Audit has sent a letter to the House of Representatives pointing out obstacles in the implementation of the General Data Protection Regulation (AVG) in the…

Discrimination Allegations Rejected: The court upholds a mortgage lender's listing on the fraud registry, despite the plaintiff's Iranian background. ⇄

Among other things, the plaintiff seeks to have an entry removed from the SFH’s (an organization) registry of fraud cases—an entry that was added by the defendant (a mortgage…

Discrimination Allegations Dismissed: Court Upholds Mortgage Lender's Listing on Fraud Register Despite Plaintiff's Iranian Background

Among other things, plaintiff seeks reversal of a listing on the SFH's fraud register by defendant (a mortgage lender) for fictitious employment. The court held that the defendant…

No complicated procedures: a free tool from noyb allowing you to object to Facebook quickly and easily! ⇄

> No nonsense, just an opt-out: a free tool from noyb allowing you to object to Facebook quickly and easily! Use the noyb tool to opt out of targeted advertising and various other…

No bullsh*t opt-out: free noyb tool for quick and broad Facebook objections!

> No bullsh*t opt-out: free noyb tool for quick and broad Facebook objections! Use the noyb tool to opt out of targeted advertising and various other claimed 'legitimate…

No bullsh*t opt-out: free noyb tool for quick and broad Facebook objections!

Forced Consent & Consent Bypass No bullsh*t opt-out: Free noyb tool for quick and broad Facebook objections is now online! As reported last week, Meta switched the legal basis for…

Meta (Facebook, Instagram) switching to "Legitimate Interest" for Ads

Forced Consent & Consent Bypass Meta (Facebook, Instagram) switching to "Legitimate Interest" for ads after noyb win. noyb will take immediate action to stop this illegal practice…

The bank must provide personal data to the complainant, in accordance with GDPR rules: Court grants counter-claim. ⇄

Interim judgment, right of access pursuant to Article 15 GDPR, applicability of Article 843a of the Civil Code.

Bank must provide personal data to claimant on GDPR: Court grants cross-claim

Interlocutory judgment, right of inspection pursuant to art 15 AVG, applicability of art 843a Rv.

“Social media profiles and phone contacts” used as proof of identity for deportations

> Thirteen non-EU countries sometimes accept “social media profiles and phone contacts” as evidence of identity for the purpose of deportations, according to an internal European…

Unprecedented appearance by European Commissioner for Home Affairs, innovating on quicksand, and the cabinet vs. online confidentiality

> Read through the most interesting developments at the intersection of human rights and technology from the Netherlands. This is the second update in this series.

The EU’s home affairs chief wants to read your private messages

> The CSA Regulation, proposed by European Commissioner Ylva Johansson, could undermine the trust we have in secure and confidential processes like sending work emails,…

The European Court of Human Rights (ECHR) has ruled that a violation of the right to a fair trial occurs when a national court fails to request a preliminary ruling from the Court of Justice of the European Union (CJEU). ⇄

Blog Post 15/2023: The obligation of national courts to request a preliminary ruling from the Court of Justice of the European Union (CJEU) is a topic that has long been debated.…

ECtHR finds violation of the right to fair trial when national court does not seek preliminary ruling from the CJEU

> Blogpost 15/2023 The obligation of national courts to seek preliminary reference from the Court of Justice of the EU (CJEU) is a long-debated topic. In EU law, it is framed as…

The member states of the European Union have reached an agreement on the Data Act. ⇄

The member states of the European Union have reached a common position on the proposed Data Regulation, allowing negotiations on the final version of the proposed legislation to…

EU member states reach agreement on Data Act

> EU member states reached a common position on the proposed Data Act, enabling negotiations on the final version of the proposed legislation to begin among the Council of the…

Majority of credit bureau "CRIF" database illegal

Credit Scoring The frequently criticized credit referencing agency CRIF GmbH has collected addresses, dates of birth and names of almost all Austrians in order to calculate…

Is the new IT service provider liable for data loss resulting from the old IT environment? ⇄

District Court of North Holland, February 15, 2023, IT 4241; ECLI:NL:RBNHO:2023:2471 (Pit v. OfficeGrip Holding et al.) This case addresses the question of whether a new provider…

Is the new ICT vendor liable for loss of data from old ICT environment?

District Court of North Holland February 15, 2023, IT 4241; ECLI:NL:RBNHO:2023:2471 (Pit v. OfficeGrip Holding c.s.) This case deals with the question of whether a new ICT…

The Norwegian Data Protection Authority has fined a company that manufactures medical equipment for violating the rules regarding the reporting of data breaches. ⇄

The Norwegian Data Protection Authority, Datatilsynet, has fined the U.S. company Argon Medical Devices 2.5 million Norwegian kroner for failing to report a data breach that…

Political microtargeting on Facebook: an election promise just for you!

Political Microtargeting, Manipulation & Tracking Today, noyb filed a series of complaints against several German political parties. The parties had used microtargeting on…

Cell phone not personal enough for GDPR protection?!

Contradictory decision from the Austrian Federal Administrative Court (BVwG): Cell phone traffic and location data are particularly sensitive data that require additional…

Austrian DSB: Meta Tracking Tools Illegal

Data Transfers Austrian DSB: Meta Tracking Tools Illegal In a groundbreaking decision in one of noybs 101 complaints, the Austrian Data Protection Authority (DSB) has decided that…

Challenge for the Facebook group: Class-action lawsuit against three companies for unlawful processing of personal data and unfair commercial practices. ⇄

Class-action lawsuit against three companies that are part of the Facebook group, based on Article 3:305a of the Civil Code (old). Processing of personal data for advertising…

BfDI Presents Its 31st Annual Report ⇄

BfDI Presents Its 31st Annual Report

It has been correctly concluded that no personal data was found in the files. ⇄

Zeeland-West-Brabant District Court, March 3, 2023, IT 4234; ECLI:NL:RBZWB:2023:1459 (Plaintiff v. Minister of Defense). Administrative law. The plaintiff filed a request to…

Rightly held that no personal data was found within the files

Zeeland-West Brabant District Court March 03, 2023, IT 4234; ECLI:NL:RBZWB:2023:1459 (Claimant v. Minister of Defense) Administrative Law. The plaintiff filed a request for access…

"Dutch District Court awards fair compensation to employee due to privacy violation." ⇄

Fair compensation following the dissolution of the employment contract by the court. The court ruled that the employer had seriously failed by severely violating the employee's…

"Dutch District Court awards billijke vergoeding for employee's privacy breach"

Fair compensation after dissolution by subdistrict court. The court held that the employer had acted seriously culpable by seriously violating the employee's privacy, not being…

"Court denies removal of BKR registration due to lack of evidence"

Interlocutory appeal. Removal of BKR registration rejected. Five-year term only just started (November 2022). For lack of substantiation, cannot establish that debts were actually…

The data subject has no right to the erasure of personal data. ⇄

Court of Appeal, 3 February 2023, IT 4226; ECLI:NL:GHDHA:2023:306 (Veilig Thuis v. the petitioner). In this case, a man requested the deletion of his personal data processed by…

Respondent has no right to erasure of personal data

Hague Court of Appeal February 3, 2023, IT 4226; ECLI:NL:GHDHA:2023:306 (Veilig Thuis v. the respondent) In this case, a man requested the deletion of his personal data processed…

"The Right to Erasure: A Legal Analysis of the Deletion of Personal Information from Veilig Thuis's Records." ⇄

Request to destroy Safe Home’s records; admissibility; right to erasure of personal data under the GDPR and the Wmo.

Data brokers: Identification possible to sell ads, not to exercise fundamental rights

Today, noyb filed a series of complaints against websites and data brokers that did not correctly address access requests using cookies as an authentication factor. The companies…

The Dutch Data Protection Authority publishes guidelines on anonymization. ⇄

The Spanish data protection authority, the Agencia Española de Protección de Datos, has published guidelines on data anonymization. These guidelines state that a trained…

AEPD issues guidance for anonymization

> Spain’s data protection authority, the Agencia Española de Protección de Datos, published guidance for anonymizing data. The guidance called for a trained professional to handle…

"Legal dispute over privacy and property rights: The court has granted permission to remove a fence and cameras, despite a claim of acquisitive rights." ⇄

Neighbor dispute. A request to remove a fence has been approved. Violation of property rights and an easement for pedestrians and a crosswalk. An appeal challenging the statute of…

"Legal Battle Over Privacy and Property Rights: Court Grants Removal of Fence and Cameras Despite Claim of Prescriptive Rights"

Neighbor dispute. Claim to remove fence granted. Infringement of property right and easement of foot and crosswalk. Appeal of statute of limitations fails. Claim to remove cameras…

"The right to be forgotten: an explanation of Articles 17 and 21 of the GDPR and Article 35 of the implementing legislation regarding requests for the removal of search results on Google Search." ⇄

Protection of personal data. Request for the removal of search results from the Google search engine: the right to be forgotten. Articles 17 and 21 of the General Data Protection…

The court has issued a ruling in the appeal by Experian against the enforcement measure of the ICO (Information Commissioner's Office). ⇄

The First-tier Tribunal has annulled parts of a 2020 enforcement decision by the UK Information Commissioner's Office (ICO) against Experian. It was confirmed therein that the…

Meta to amend terms and conditions for the United Kingdom and will continue to safeguard data flows. ⇄

Meta plans to amend its terms of service and privacy policies for users in the United Kingdom, Bloomberg reports. Facebook, Instagram, and WhatsApp users in the United Kingdom…

Meta to change UK terms of service, maintain data flows

> Meta plans to change its terms of service and privacy notices for U.K. users, Bloomberg reports. U.K. Facebook, Instagram and WhatsApp users will retain data rights under the…

The Impact of Anonymizing the Names of Defendants in Court Rulings: Privacy, the General Data Protection Regulation (GDPR), and Compensation for Emotional Distress. ⇄

Anonymizing the defendant's name in a judgment, GDPR (General Data Protection Regulation), invasion of privacy, non-pecuniary damages.

The Impact of Anonymizing Suspect Names in Court Rulings: Privacy, GDPR, and Compensation for Psychological Harm.

anonymizing defendant's name in judgment, GDPR, invasion of privacy, intangible damages

The Legal Consequences of Using Unauthorized Portraits Without Consent: A Case Study. ⇄

21 Aw: The portrait, which was not commissioned, is being used. Is the publication of the portrait prohibited because it conflicts with a legitimate interest of the person…

The Legal Implications of Using Uncommissioned Portraits Without Consent: A Case Study

21 Aw: portrait, which was not commissioned, is used. Is publication of the portrait not permitted because a reasonable interest of the person portrayed opposes it? No consent…

Credit agency prohibited from collecting data via access requests and civil registries

Credit Scoring Credit agency prohibited from collecting data via access requests and civil registries Two years ago, noyb filed a GDPR complaint against credit data broker KSV…

Data Protection Day: Are Europeans really protected?

European Data Protection Day on 28 January commemorates the signing of the first pan-European data protection framework (Convention108) in 1981. Today, 42 years later, the GDPR is…

Location data is personal data - noyb wins appeal against Spanish DPA

The Spanish Courts annulled a past decision by the Spanish DPA (AEPD). The AEPD had previously argued that Virgin telco, a telecommunications provider, had lawfully denied its…

Data Protection Authorities support noyb's call for fair yes/no cookie banners

Cookie Banners A task force within the European Data Protection Board (EDPB) issued a draft report in reaction to noyb's 700+ cookie banner complaints. The European Data…

Just € 5,5 Million on WhatsApp. DPC finally gives the finger to EDPB.

WhatsApp faces € 5.5 million fine, as DPC limits the scope of the case against WhatsApp and rejects the EDPB request to investigate matters like data sharing within Meta. As…

Irish Data Protection Authority gives € 3.97 billion present to Meta.

Forced Consent & Consent Bypass Irish Data Protection Authority gives € 3.97 billion present to Meta? Authority allegedly unable to take financial benefit from Meta's GDPR…

Meta Advertising Ban - Decision Published

Forced Consent & Consent Bypass The Irish DPC issued its final decision on Meta's illegal processing of user data for personal advertising. Here is a download link and a first…

BREAKING: Meta prohibited from use of personal data for advertising

Forced Consent & Consent Bypass BREAKING: Meta (Facebook and Instagram) prohibited from using personal data for advertisement. Major blow to Meta's business model in Europe,…

Statement on EU Comission adequacy decision on US

Data Transfers Statement on US Adequacy Decision by the European Commission Today, the European Commission issued a new adequacy decision replacing the"Privacy Shield" decision,…

noyb win: Personalized Ads on Facebook, Instagram and WhatsApp declared illegal

Forced Consent & Consent Bypass noyb complaints: Meta's business model declared illegal in the EU according to WSJ. Facebook, Instagram and WhatsApp can no longer run personalized…

An analysis of Dutch case law: what factors play a role in awarding (or not) and determining the extent of damages under the GDPR? ⇄

Since May 2018, the GDPR has been directly applicable in the European Economic Area, including the member states of the European Union, Liechtenstein, Norway, and Iceland. Four…

GDPR Rights in Sweden: Court confirms that authority must investigate complaints.

Forced Consent & Consent Bypass GDPR Rights in Sweden: Court confirms that authority must investigate complaints. So far, the Swedish IMY has taken the view that users don’t have…

The AEPD (Dutch Data Protection Authority) has developed a tool that allows data controllers to identify the relevant authorities to which a data breach must be reported. ⇄

The Spanish data protection authority, the Agencia Española de Protección de Datos, has developed a tool to help organizations determine whether they need to notify a data…

AEPD creates tool for data controllers to identify relevant authorities to report a breach

> Spain’s data protection authority, the Agencia Española de Protección de Datos, created a tool designed to help organizations determine whether to notify a data protection…

Evidence of Fairness in Algorithmic Decision-Making: A Systematic Review of the Empirical Literature. ⇄

Algorithmic decision-making is having an increasing impact on people’s daily lives. Since such autonomous systems can cause serious harm to individuals and social groups, concerns…

Fairness perceptions of algorithmic decision-making: A systematic review of the empirical literature

> Algorithmic decision-making increasingly shapes people's daily lives. Given that such autonomous systems can cause severe harm to individuals and social groups, fairness…

CJEU: processing personal data liable to disclose indirectly sexual orientation constitutes processing of special categories of personal data

In 'Vyriausioji Tarnybinės Etikos Komisija' the CJEU held that the name of civil servants' spouse, cohabitant or partner and of the subject of their transactions (indirectly…

The Danish regulatory authority (SA) has imposed a fine of approximately 67,000 euros on a law firm that was hit by ransomware, due to inadequate security measures. ⇄

The Danish Data Protection Authority (DPA) found that the law firm did not have the necessary security measures in place, especially given that the firm handled special categories…

Overview of the EU's data strategy: the Digital Services Act. ⇄

The Digital Services Act was published in the Official Journal of the European Union on October 27. The DSA, which harmonizes the conditions for the provision of intermediary…

Overview of EU Strategy for Data: Digital Services Act

> The Digital Services Act was published in the Official Journal of the European Union Oct. 27. The DSA, which harmonizes conditions for the provision of intermediary services and…

AP is highly critical of the Tax Authority's proposed new approach to FSV processing ⇄

Digitization, Surveillance, Colonialism

This article discusses the importance of privacy in the context of the recent Supreme Court ruling on abortion in the United States. The ruling has led to the potential for…

Big Data Analysis, Technology in the Insurance Sector, and Consumer Contracts: A European Overview. ⇄

Automated personalization in consumer insurance contracts is not yet a reality in Europe, but the mass customization and automation of insurance contracts are becoming an…

Where did all the “reject” buttons come from?!

Cookie Banners Where did all the “reject” buttons come from?! More and more websites have added an option to say “no” to cookies and other tracking- as foreseen by the GDPR. Where…

Directly discriminatory algorithms. ⇄

There is a broad consensus that algorithmic systems should primarily be approached from the perspective of indirect discrimination and their impact, but researchers argue that…

Directly Discriminatory Algorithms

There is a broad consensus that algorithmic systems should be approached principally through the lens of indirect discrimination and their impact, but researchers argue that this…

The Impact of the CLOUD Act on Data Storage in Europe. ⇄

At the request of the Dutch government, GreenbergTraurig assessed the scope of the U.S. CLOUD Act. The CLOUD Act applies to EU organizations that process data outside the United…

Recommendation Systems You Can Trust: A Legal and Empirical Perspective on the Transparency and Control Individuals Need to Trust News Personalization. ⇄

The law can play an important role in ensuring trust in organizations that use news personalization. Measures for oversight and transparency are crucial to ensuring that…