Berlin Group Adopts Working Paper on “Smart Cities” ⇄
Berlin Group Adopts Working Paper on “Smart Cities”
Data protection and digital regulation developments, collected automatically from 17+ sources.
Get this as an email digestBerlin Group Adopts Working Paper on “Smart Cities”
Forced Consent & Consent Bypass Today, noyb filed three complaints against Fitbit in Austria, the Netherlands and in Italy. The popular health and fitness company, acquired by…
Annual Report 2022 In 2022, noyb continued its longstanding fight for users’ right to privacy. Although the GDPR always foresaw a strong role for non-profits in this regard, we…
Data Transfers 23 years of illegal data transfers due to inactive DPAs and new EU-US deals In two landmark rulings in 2015 and 2020, the Court of Justice of the European Union…
Forced Consent & Consent Bypass Meta apparently switches to consent for behavioral ads after five years of litigation After more than five years of extensive litigation by noyb,…
Biometric Data Today, noyb filed a complaint against Ryanair. When booking through an online travel agent and not directly on its website or app, Europe’s biggest airline requires…
Cookie Banners Unlawful Cookie Banners: Belgian DPA let news outlets buy themselves free from GDPR compliance Belgian news outlets relying on illegal cookie banners paid € 10.000…
Forced Consent & Consent Bypass Norwegian DPA temporarily bans behavioral advertising on Facebook and Instagram Following a CJEU ruling that declared Meta/Facebook’s GDPR approach…
Cookie Banners „Pay or Okay“ on tech news site heise.de illegal, decides German DPA. Major implications for many other German news pages. One of the largest German-language tech…
Data Transfers Open letter: Repeated false allegations of a “business model” when citizens exercise their rights Instead of focusing on the legal matters of the supposedly new…
Data Transfers New Trans-Atlantic Data Privacy Framework largely a copy of "Privacy Shield". noyb will challenge the decision. Third attempt of the European Commission to get a…
The GDPR allows for six legal bases to process personal data. In the case Meta v Bundeskartellamt, the CJEU has today ruled on all of them - further clarifying the interpretation…
National Administrative Procedures and DPA inactivity GDPR Procedures Regulation: Commission Proposal is an attack on users' rights in GDPR procedures Today the EU Justice…
The BfDI Welcomes the ECJ's Meta Ruling
Data Transfers noyb win: First major fine (€ 1 million) for using Google Analytics Following noyb’s 101 complaints on unlawful EU-US data transfers, the Swedish data protection…
Ireland makes questionable GDPR cases 'confidential'. Irish DPC will likely use Section 26A to muzzle criticism. Despite profound criticism by civil society (ICCL, Amnesty, EDRi,…
National Administrative Procedures and DPA inactivity Ireland: Reporting about DPC procedures soon a crime! Irish Parliament can stop last-minute "gag order" amendment. In a…
Profiling & Automated Decision Making Today, noyb filed a complaint against TeleSign, a US company which profiled millions of phone users. TeleSign generates a “reputation score”…
Data Subject Rights The French Data Protection Authority (CNIL) fined Criteo, a major online advertisement and tracking company in Europe, €40 million for violating the GDPR. This…
IFK Calls for a Modern Federal Press Law
Data Subject Rights Following a noyb complaint and litigation over inactivity, the Swedish Data Protection Authoirty (IMY) has issued a fine of 58 Mln Swedish Crown (about € 5…
Joint Press Release – Uniform Rules for Data Protection Fines in Europe
Credit Scoring noyb's legal proceedings against the credit reporting agency CRIF are uncovering a multitude of legal violations and cynical interpretations of the GDPR, exposing a…
BfDI Draws Positive Conclusions on 5 Years of the GDPR
5 Years of the GDPR—The General Data Protection Regulation as a Benchmark in the Digital Landscape
. 85% of noyb cases not decided.On 25 May 2018, the GDPR came into force. While the contents of EU data protection rules stayed largely the same, the alleged big change was the…
The publication of its activity report enables the CNIL to report on its actions with regard to its four major missions: inform and protect the general public, accompany and…
Data Transfers Today, a decade-long (2013 - 2023) case on Meta's involvement in US mass surveillance has lead to a first direct decision. Meta must stop any further transfers of…
Political Microtargeting, Manipulation & Tracking Data Breach in Malta: Company must disclose source within 20 days or face penalties The Maltese Data Protection Authority (IDPC)…
Background information Following a complaint by the PRIVACY INTERNATIONAL association, the CNIL carried out four investigations into DOCTISSIMO. The doctissimo.fr website mainly…
The main thing is: The CNIL has been undertaking work for several years to anticipate and respond to the issues raised by AI. In 2023, it will extend its action on augmented…
Purchase. Claim for damages against the client. The right to invoke the doctrine of estoppel is recognized. The plaintiff did not challenge the tender decision within 20 days in a…
> Procurement. Claim for damages against contracting authority. Reliance on estoppel succeeds. Plaintiff did not challenge the award decision in interlocutory proceedings within…
Request for Release of Source Code. Usage Fees. Unlawful Removal of Source Code?
> Claim for release of source code. Use fee. Unlawful removal of source code? (Machine translated)
The harmful consequences of so-called artificial intelligence are real and current, and are the result of the actions of individuals and companies deploying automated systems.…
> The harms from so-called AI are real and present and follow from the acts of people and corporations deploying automated systems. Regulatory efforts should focus on…
Termination of employment due to a disrupted working relationship, serious fault on the part of the employer resulting from insufficient support during the first attempt at…
> Dissolution because of a disturbed employment relationship, serious culpability of the employer because of insufficient reintegration in the first track and justified complaints…
On December 1, 2020, a cyberattack occurred at the municipality, during which the municipality's network and backup systems were encrypted and rendered inaccessible, and many…
> On December 1, 2020, a cyber attack took place at the municipality, encrypting and making inaccessible the municipality's network and backup systems and deleting many virtual…
Background information CLEARVIEW AI collects photographs from a wide range of websites, including social networks, and sells access to its database of images of people through a…
The Austrian data protection authority has decided: Clearview AI, the company that sells facial recognition software to law enforcement agencies in the U.S. is no longer allowed…
Background information CLEARVIEW AI collects photos from a wide range of websites, including social networks, and sells access to its database of images of individuals via a…
, contrary to national courts. Today, the Court of Justice of the European Union (CJEU) issued the first judgment on emotional damages under the GDPR, confirming that the GDPR…
noyb wins at the CJEU: Right to information must include context - in some cases also documents and database excerpts Yesterday, the Court of Justice of the European Union (CJEU)…
Camera surveillance of harmful emissions at Tata Steel’s processing plant is not illegal. The surveillance in question is effective and not targeted at individuals. The likelihood…
Camera surveillance of harmful emissions at Tata Steel's cooking plant is not unlawful. Spoken of effective surveillance that is not directed at individuals. Very low likelihood…
Cassation in the interest of the law. Public nature of civil proceedings. Are courts obliged to provide third parties with information regarding civil proceedings that are ongoing…
Cassation in the interest of the law. Disclosure of civil proceedings. Are courts required to disclose to others than parties information about civil proceedings that are or have…
Following the implementation of the EU Whistleblower Directive in 2021, companies’ data protection officers were tasked with establishing secure reporting channels. Since these…
> Following the implementation of the EU Whistleblower Directive in 2021, companies' data protection officers were tasked with setting up secure reporting channels. As these data…
Judgment drafted by: Diederik Stols, Hanna van Til, and Otto Volgenant, Boekx Advocaten. Amsterdam District Court, April 12, 2023, IEF 21357; ECLI:NL:RBAMS:2023:2192 (EOKM v.…
Judgment submitted by: Diederik Stols, Hanna van Til, and Otto Volgenant, Boekx AdvocatenRb. Amsterdam April 12, 2023, IEF 21357; ECLI:NL:RBAMS:2023:2192 (EOKM v. Hammy Media) The…
Pornographic websites must demonstrate that persons who are identifiable in images that have not been professionally produced have given their consent for the disclosure of their…
Porn website must be able to prove that individuals who are recognizable in images in non-professionally created footage have given their consent to disclosure.
Cookie Banners "Pay or Okay" - the beginning of the end? "PUR Abo" on derStandard.at illegal according to Austrian DPA After the GDPR came into force, the Austrian daily newspaper…
Request from Uber drivers to Uber for information under Article 15(1)(h) AVG (information about the existence of automated decision-making within the meaning of Article 22 AVG)…
ECJ EU, March 30, 2023, IT 4246; ECLI:EU:C:2023:270 (Main Staff Council of Teachers at the Hessian Ministry of Education v. Minister of the Hessian Ministry of Education). The…
ECJ EU March 30, 2023, IT 4246; ECLI:EU:C:2023:270 (Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v. Minister des Hessischen Kultusministeriums)…
Request by drivers to Ola Netherlands BV for access as referred to in Article 15 (1) AVG to certain personal data concerning them (including "ratings" given by passengers) and for…
Request by Uber drivers to Uber for access to certain personal data relating to them (including "ratings" provided by passengers), as referred to in Article 15(1) GDPR, and for…
Request from Uber drivers to Uber for access as referred to in Article 15 (1) AVG to certain personal data concerning them (including "ratings" given by passengers) and for…
Request from Uber drivers to Uber for information pursuant to Article 15(1)(h) GDPR (information on the existence of automated decision-making within the meaning of Article 22…
The Netherlands Court of Audit has sent a letter to the House of Representatives highlighting bottlenecks in the implementation of the General Data Protection Regulation (GDPR) in…
The Court of Audit has sent a letter to the House of Representatives pointing out obstacles in the implementation of the General Data Protection Regulation (AVG) in the…
Among other things, the plaintiff seeks to have an entry removed from the SFH’s (an organization) registry of fraud cases—an entry that was added by the defendant (a mortgage…
Among other things, plaintiff seeks reversal of a listing on the SFH's fraud register by defendant (a mortgage lender) for fictitious employment. The court held that the defendant…
> No nonsense, just an opt-out: a free tool from noyb allowing you to object to Facebook quickly and easily! Use the noyb tool to opt out of targeted advertising and various other…
> No bullsh*t opt-out: free noyb tool for quick and broad Facebook objections! Use the noyb tool to opt out of targeted advertising and various other claimed 'legitimate…
Forced Consent & Consent Bypass No bullsh*t opt-out: Free noyb tool for quick and broad Facebook objections is now online! As reported last week, Meta switched the legal basis for…
Forced Consent & Consent Bypass Meta (Facebook, Instagram) switching to "Legitimate Interest" for ads after noyb win. noyb will take immediate action to stop this illegal practice…
> The growth of generative artificial intelligence systems has led EU lawmakers to focus on General Purpose AI in drafting the AI Act, which will set the framework governing…
Interim judgment, right of access pursuant to Article 15 GDPR, applicability of Article 843a of the Civil Code.
Interlocutory judgment, right of inspection pursuant to art 15 AVG, applicability of art 843a Rv.
> Thirteen non-EU countries sometimes accept “social media profiles and phone contacts” as evidence of identity for the purpose of deportations, according to an internal European…
> Read through the most interesting developments at the intersection of human rights and technology from the Netherlands. This is the second update in this series.
> The CSA Regulation, proposed by European Commissioner Ylva Johansson, could undermine the trust we have in secure and confidential processes like sending work emails,…
> Personal data protection and whistleblowing are two different topics — different regulations with different purposes, scope and requirements. But, in fact, they are closer than…
Blog Post 15/2023: The obligation of national courts to request a preliminary ruling from the Court of Justice of the European Union (CJEU) is a topic that has long been debated.…
> Blogpost 15/2023 The obligation of national courts to seek preliminary reference from the Court of Justice of the EU (CJEU) is a long-debated topic. In EU law, it is framed as…
The member states of the European Union have reached a common position on the proposed Data Regulation, allowing negotiations on the final version of the proposed legislation to…
> EU member states reached a common position on the proposed Data Act, enabling negotiations on the final version of the proposed legislation to begin among the Council of the…
Credit Scoring The frequently criticized credit referencing agency CRIF GmbH has collected addresses, dates of birth and names of almost all Austrians in order to calculate…
> Norway's data protection authority, the Datatilsynet, fined U.S.-based Argon Medical Devices 2.5 million kroner for failing to report a July 2021 data breach within the 72-hour…
District Court of North Holland, February 15, 2023, IT 4241; ECLI:NL:RBNHO:2023:2471 (Pit v. OfficeGrip Holding et al.) This case addresses the question of whether a new provider…
District Court of North Holland February 15, 2023, IT 4241; ECLI:NL:RBNHO:2023:2471 (Pit v. OfficeGrip Holding c.s.) This case deals with the question of whether a new ICT…
The Norwegian Data Protection Authority, Datatilsynet, has fined the U.S. company Argon Medical Devices 2.5 million Norwegian kroner for failing to report a data breach that…
Political Microtargeting, Manipulation & Tracking Today, noyb filed a series of complaints against several German political parties. The parties had used microtargeting on…
Contradictory decision from the Austrian Federal Administrative Court (BVwG): Cell phone traffic and location data are particularly sensitive data that require additional…
Data Transfers Austrian DSB: Meta Tracking Tools Illegal In a groundbreaking decision in one of noybs 101 complaints, the Austrian Data Protection Authority (DSB) has decided that…
Collective action against three companies of the Facebook group under Art. 3:305a BW (old). Processing personal data for advertising purposes without a basis as referred to in the…
Class-action lawsuit against three companies that are part of the Facebook group, based on Article 3:305a of the Civil Code (old). Processing of personal data for advertising…
BfDI Presents Its 31st Annual Report
Zeeland-West-Brabant District Court, March 3, 2023, IT 4234; ECLI:NL:RBZWB:2023:1459 (Plaintiff v. Minister of Defense). Administrative law. The plaintiff filed a request to…
Zeeland-West Brabant District Court March 03, 2023, IT 4234; ECLI:NL:RBZWB:2023:1459 (Claimant v. Minister of Defense) Administrative Law. The plaintiff filed a request for access…
Interlocutory appeal. The request to remove the BKR registration was denied. The five-year period has only just begun (November 2022). There is insufficient evidence to…
Fair compensation following the dissolution of the employment contract by the court. The court ruled that the employer had seriously failed by severely violating the employee's…
Fair compensation after dissolution by subdistrict court. The court held that the employer had acted seriously culpable by seriously violating the employee's privacy, not being…
Interlocutory appeal. Removal of BKR registration rejected. Five-year term only just started (November 2022). For lack of substantiation, cannot establish that debts were actually…
Court of Appeal, 3 February 2023, IT 4226; ECLI:NL:GHDHA:2023:306 (Veilig Thuis v. the petitioner). In this case, a man requested the deletion of his personal data processed by…
Hague Court of Appeal February 3, 2023, IT 4226; ECLI:NL:GHDHA:2023:306 (Veilig Thuis v. the respondent) In this case, a man requested the deletion of his personal data processed…
Request for destruction of Safe Home files; admissibility; right to erasure of personal data under the AVG and Wmo
Request to destroy Safe Home’s records; admissibility; right to erasure of personal data under the GDPR and the Wmo.
Today, noyb filed a series of complaints against websites and data brokers that did not correctly address access requests using cookies as an authentication factor. The companies…
The Spanish data protection authority, the Agencia Española de Protección de Datos, has published guidelines on data anonymization. These guidelines state that a trained…
> Spain’s data protection authority, the Agencia Española de Protección de Datos, published guidance for anonymizing data. The guidance called for a trained professional to handle…
Personal data protection. Request for removal of search results from the Google Search search engine: the right to be forgotten. Articles 17 and 21 General Data Protection…
Neighbor dispute. A request to remove a fence has been approved. Violation of property rights and an easement for pedestrians and a crosswalk. An appeal challenging the statute of…
Neighbor dispute. Claim to remove fence granted. Infringement of property right and easement of foot and crosswalk. Appeal of statute of limitations fails. Claim to remove cameras…
Protection of personal data. Request for the removal of search results from the Google search engine: the right to be forgotten. Articles 17 and 21 of the General Data Protection…
> The First-Tier Tribunal overturned portions of a 2020 enforcement notice by the U.K. Information Commissioner's Office against Experian, confirming the company's reliance on…
The First-tier Tribunal has annulled parts of a 2020 enforcement decision by the UK Information Commissioner's Office (ICO) against Experian. It was confirmed therein that the…
Meta plans to amend its terms of service and privacy policies for users in the United Kingdom, Bloomberg reports. Facebook, Instagram, and WhatsApp users in the United Kingdom…
> Meta plans to change its terms of service and privacy notices for U.K. users, Bloomberg reports. U.K. Facebook, Instagram and WhatsApp users will retain data rights under the…
Anonymizing the defendant's name in a judgment, GDPR (General Data Protection Regulation), invasion of privacy, non-pecuniary damages.
anonymizing defendant's name in judgment, GDPR, invasion of privacy, intangible damages
21 Aw: The portrait, which was not commissioned, is being used. Is the publication of the portrait prohibited because it conflicts with a legitimate interest of the person…
21 Aw: portrait, which was not commissioned, is used. Is publication of the portrait not permitted because a reasonable interest of the person portrayed opposes it? No consent…
Credit Scoring Credit agency prohibited from collecting data via access requests and civil registries Two years ago, noyb filed a GDPR complaint against credit data broker KSV…