Data protection and digital regulation developments, collected automatically from 17+ sources.
Get this as an email digestLaw can play an important role in safeguarding trust in organisations that use news personalisation. Control and transparency measures are crucial to enabling individuals to trust…
The Garante (the Italian Data Protection Authority) notes that European data protection legislation does not, in principle, prevent a website owner from making access to content…
> The Garante notes that the European legislation on the protection of personal data does not in principle preclude the owner of a site from making access to content by users…
An overview of the fine imposed on IAPP: https://iapp.org/news/a/a-rundown-of-the-greek-dpas-clearview-ai-fine-findings
Cookie Banners Two are better than one?! Profil.at strikes back with forced banner, when users make the "wrong" choice. Today, noyb.eu filed a GDPR complaint against the Austrian…
A rundown of the fine on IAPP: https://iapp.org/news/a/a-rundown-of-the-greek-dpas-clearview-ai-fine-findings
> On October 14, 2022, the Federal Trade Commission announced it is extending the deadline by one month to submit comments on its Advanced Notice of Proposed Rulemaking on…
There is a significant discrepancy between the legal and ethical rules for governance and the daily practice of professionals in the public sector working with data. These…
There is a wide gap between legal and ethical governance rules and the everyday practices of public sector data professionals. Frameworks are integrated implicitly, subtly…
According to Article 14 of the Standard Contractual Clauses (SCCs) for data exchange, the party importing the data must conduct a risk assessment to verify whether the laws,…
Under Clause 14 of the Data Transfer SCCs, the data importer must carry out a transfer risk assessment to verify whether the laws and practices of the receiving third country…
On October 14, 2022, the Federal Trade Commission announced that the deadline for submitting comments on its preliminary proposal for regulation regarding commercial surveillance…
The Commission has enthusiastically supported a recent US decision to implement a new framework for the protection of the privacy of personal data exchanged between the US and…
The Commission has endorsed enthusiastically a recent US order to implement a new framework to protect the privacy of personal data shared between the US and Europe. Dick Roche…
Hardly noticed by the general public, the Advocate General (AG) of the Court of Justice of the European Union (CJEU) has issued an opinion, aiming to limit one of the last…
The concept of proportionality is at the very core of the modern understanding of human rights. Proportionality is, first and foremost, a condition for the limitation of a…
The Advocate General of the Court of Justice of the European Union (CJEU) has issued a non-binding opinion that has privacy advocates concerned, as it could further limit users’…
Legal Analysis: No non-material damages for GDPR violations (C-300/21)? By Max Schrems | Download the PDF Version of this Legal Analysis On 6 October 2022, Advocate General (AG)…
The GDPR risk assessment is intended to help controllers and processors identify the risk factors affecting the rights and freedoms of data subjects whose data is being processed.…
> GDPR RISK ASSESSMENT is intended to assist controllers and processors to identify the risk factors for the rights and freedoms of data subjects whose data are present in the…
Machine learning can be used to optimize sales practices in consumer markets, but it also raises concerns about manipulation. According to this article, in order to mitigate these…
Self-sovereign identity is a technology in the early stages of development, and its benefits for refugees remain uncertain. While it may give them greater autonomy, it also risks…
Self-sovereign identity is an embryonic technology with uncertain benefits for refugees. It may help to empower them, but it also risks reinforcing the power of states and…
Proposals regarding data ownership are misplaced and would be counterproductive if implemented. Instead, reform of privacy laws should focus on strengthening existing restrictions…
Data ownership proposals are misguided and would be self-defeating if implemented. Instead, privacy law reform should focus on strengthening ongoing use restrictions over personal…
Machine learning can be used to optimize sales strategies in the consumer market, but it also raises concerns about manipulation. According to this article, it is important to…
Data protection authorities (DPAs) are independent bodies responsible for the consistent application of the GDPR, and they are required to facilitate the filing of complaints.…
DPAs are independent authorities entrusted with the consistent application of the GDPR, and are obliged to facilitate the submission of complaints. However, according to this…
> Legally, until an adequacy determination is granted, companies should continue to follow the European Data Protection Board’s recommendations on measures that supplement…
From a legal standpoint, until an adequacy determination has been issued, companies must continue to follow the recommendations of the European Data Protection Board (EDPB)…
Data Transfers We are now working on an in-depth analysis, which will be published on noyb.eu in the next days. First reaction: Executive Order on US Surveillance unlikely to…
The European Digital Rights (EDRi) network has published a position paper on the proposed European regulatory framework for automated data exchange to promote cooperation among…
> Privacy protection is not absolute. In fact, this is stated explicitly in privacy legislation. The GDPR therefore includes various exceptions. One of the exceptions that appears…
This article examines the installation and configuration process for consent pop-ups, as well as their potential implications for website publishers’ decision-making. It finds…
This paper studies the installation and configuration process of consent pop-ups and their potential effects on website publishers' decision making. It finds that Consent…
The European Digital Rights (EDRi) network published a position paper on the proposed Regulation on automated data exchange for police cooperation, known as “Prüm II”. This…
Mr. Depoorter realized that he could develop an automated way to combine these publicly available camera feeds with the photos people had posted on Instagram. Over the course of…
> Mr. Depoorter realized that he could come up with an automated way to combine these publicly available cameras with the photos that people had posted on Instagram. So, over a…
The 405 million euro fine imposed on Meta by the Irish Data Protection Authority marks a “crucial moment” in the enforcement of the European General Data Protection Regulation…
The U.K. Information Commissioner's Office has reprimanded seven government and private organizations and issued recommendations regarding their practices for failing to respond…
> The Irish Data Protection Commission’s 405 million euro fine against Meta represents a “watershed moment” in EU General Data Protection Regulation enforcement, write Bird &…
> The U.K. Information Commissioner’s Office issued reprimands and practice recommendations for seven public and private entities for failure to respond to subject access…
The Data Protection Authority (DPA) emphasized that simply entering into a data processing agreement that includes security requirements is not sufficient. The controller must…
The Data Protection Authority (DPA) of Lower Saxony has fined a bank 900,000 euros for creating customer profiles—supplemented with third-party data—for advertising purposes…
The Belgian Data Protection Authority (SA) has ruled that a data controller may rely on a legitimate interest as the legal basis for sending direct marketing to former customers,…
The Belgian Data Protection Authority (SA) has ruled that discussing an employee’s personal health information during a meeting in which she was not present, and subsequently…
The Icelandic Data Protection Authority (SA) has determined that a conflict of interest exists when a Data Protection Officer (DPO) also serves as a senior legal counsel, deputy…
The Spanish Data Protection Authority (SA) has fined an individual 10,000 euros for publishing a third party’s personal data on an online blog without that person’s consent.…
Finally, the data protection authority ruled that the controller’s decision to involve the data protection officer (DPO) in the defense during legal proceedings placed the DPO in…
The Danish Data Protection Authority (DPA) has temporarily suspended its processing ban against the municipality of Helsingør, regarding the use of Google Chromebooks and…
The European Commission has adopted a proposal to harmonize the rules regarding consumer compensation in the Directive on Liability for Artificial Intelligence. The proposed rules…
The French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), has developed a checklist for organizations that store health data. This…
> France’s data protection authority, the Commission nationale de l'informatique et des libertés, created a compliance checklist for controllers operating health data warehouses.…
> The European Commission adopted a proposal for harmonizing rules around consumer redress in the Artificial Intelligence Liability Directive. The proposed rules will allow…
The GDPR incorporates the RBA for all obligations of the controller in the GDPR. Where the transfer rules are stated as obligations of the controller (rather than as absolute…
> * We propose a framework for defining different types of explanations for AI systems. > * We situate current discussions on "Explainable AI" (XAI) within this proposed…
> * We propose a framework for defining different types of explanations of AI systems. > * We contextualize current XAI discourses within the proposed framework. > * We highlight…
The CLOUD Act agreements between the US and UK will likely improve the digital privacy rights of US and UK citizens, but they will further undermine these rights for Third Country…
The CLOUD agreements between the U.S. and the United Kingdom are likely to improve the digital privacy rights of U.S. and U.K. citizens, but they will further erode these rights…
> Registering the target's license plate in parking apps and enabling license plate recognition (ANPR). I could add as many plates as I wanted. Doesn't matter if they already used…
The UK Information Commissioner's Office has announced that TikTok will be fined 27 million pounds for alleged violations of UK data protection laws. The ICO’s investigation…
> The U.K. Information Commissioner's Office announced a notice of intent to fine TikTok 27 million GBP for alleged U.K. data protection violations. The ICO's investigation found…
Data Transfers Half a year of political announcements, but no agreement on EU-US data transfers. On 25 March 2022, in the wake of the war on Ukraine, US-President Joe Biden and…
The Berlin Commissioner for Data Protection and Freedom of Information has imposed a fine of 525,000 euros on a Berlin-based retailer for violating the requirements regarding the…
> The Berlin Commissioner for Data Protection and Freedom of Information issued a 525,000 euro fine to a Berlin-based retailer for violation of data protection officer…
The Danish Data Protection Agency has conducted an investigation into the Google Analytics tool and its settings, as well as the terms under which the tool is offered. Based on…
The Danish Data Protection Agency has looked into the tool Google Analytics and its settings, and the terms under which the tool is provided. On the basis of this review, the…
> The EU has identified artificial intelligence (AI) as one of the most relevant technologies of the 21st century and highlighted 1 its importance on the strategy for EU’s digital…
The European Union has identified artificial intelligence (AI) as one of the most significant technologies of the 21st century and emphasizes 1 its importance in the EU’s digital…
The Office of the UN High Commissioner for Human Rights has published a report describing how “modern, interconnected digital technologies” threaten individuals’ privacy. The…
> The United Nations Office for the High Commissioner of Human Rights issued a report detailing how “modern networked digital technologies” threaten individuals’ privacy. The…
> Following the EDPB’s binding dispute resolution decision of July 28th, the Irish Data Protection Authority (DPA) has adopted its decision regarding Instagram (Meta Platforms…
Following the binding decision by the European Data Protection Board (EDPB) on July 28, the Irish Data Protection Authority (DPA) adopted its decision regarding Instagram (Meta…
The European Data Protection Supervisor has ordered Europol to transfer personal data to Dutch activist Frank van der Linde. This decision is the result of a two-year…
The European Data Protection Supervisor ordered Europol to hand over personal data to Dutch activist Frank van der Linde. The decision is the result of a two-year investigation…
The EDPB has adopted a statement on the European Commission’s proposal for an EU Code on Police Cooperation. The purpose of this proposal is to improve law enforcement cooperation…
The EDPB adopted a statement on the European Commission’s proposal for an EU Police Cooperation Code. This proposal aims to enhance law enforcement cooperation across Member…
"We are deeply concerned that, unless it is significantly increased, the 2023 budget will be far too small to enable the EDPB and the EDPS to carry out their duties adequately,"…
> “We are deeply concerned that the 2023 budget, if not substantially increased, will be significantly too small to allow the EDPB and the EDPS to fulfil their tasks…
The fine is the result of an investigation that began in 2020 and focused on how the company processed children’s personal data. Based on media reports, the investigation focused…
> The fine is the result of an investigation that began in 2020 and focused on the company’s processing of children’s personal data. Based on press reports, the investigation…
The current version of the bill aims to preserve most of the key principles underlying the UK’s data protection framework, while at the same time amending certain key provisions…
> The current version of the Bill seeks to maintain the majority of key principles that underpin the UK data protection law framework, while at the same time modifying certain key…
Today, noyb.eu filed a complaint against Google with the French Data Protection Authority (CNIL). The tech giant has repeatedly ignored the European Court of Justice (CJEU) ruling…
"Based on the facts of the case, we do not see how [Meta] could have continued its transfer of personal data after the ruling in the Schrems II case if it had complied with the…
> “Based on the facts of the case, we do not see how [Meta] could have continued its personal data transfers following the Schrems II judgment had it acted in accordance with the…
This article argues that viewing the negative consequences of artificial intelligence as risks is a deliberate choice with consequences. Risk management presents its own specific…
> This Article observes that constructing AI harms as risks is a choice with consequences. Risk regulation comes with its own policy baggage: a set of tools and troubles that have…
The Belgian Data Protection Authority (SA) has fined a medical laboratory 20,000 euros for violating Articles 5(1)(f), 12, 13, 14, 24, 25, 32, 35(1), and 35(3) of the General Data…
The Belgian SA fined a medical laboratory €20,000 for violating Articles 5(1)(f), 12, 13, 14, 24, 25, 32, 35(1), and 35(3) GDPR due to a lack of security and a privacy policy on…
> As part of its data strategy, the European Commission has presented a number of legislative instruments, including the Digital Markets Act (DMA), the Digital Services Act (DSA),…
The processing of personal data that may indirectly reveal sensitive information about an individual, such as information about their sexual orientation, may qualify as processing…
Cookie Banners Final round of “One Trust” cookie banners: 226 complaints lodged against deceptive cookie banners that are still not complying with GDPR requirements Today, noyb…
The proposed fine follows complaints filed against Criteo by the privacy organization "Privacy International." [...] As part of the CNIL’s sanction proceedings, Criteo has the…
> The proposed fine follows complaints filed by privacy NGO ‘Privacy International’ against Criteo. […] Under the CNIL’s sanction procedure, Criteo has the right to respond to the…
On June 21, 2022, the General Court of the European Union (Grand Chamber) issued a landmark ruling in which it upheld the EU regime for the collection and use of passenger data,…
> In a landmark ruling of 21 June 2022, the CJEU (Grand Chamber), upheld the EU’s regime to collect and use records of travellers, provided that it is strictly interpreted in line…
On April 5, 2022, the Court of Justice of the European Union (CJEU) added a new chapter to the long history of data retention admissibility within the EU. In a case concerning…
> On 5 April 2022, the CJEU added another chapter to the long history of the admissibility of data retention in the EU. In a case concerning the data retention law in Ireland, the…
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a joint opinion on the proposal for a regulation to combat child sexual…
> The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a Joint Opinion on the Proposal for a Regulation to prevent and combat child…
> A firehose of sensitive data from your vehicle is flowing to a group of companies you’ve probably never heard of
> Thirty study participants playtested an innocent-looking "escape room" game in virtual reality (VR). Behind the scenes, an adversarial program had accurately inferred over 25…
Annual Report 2021 2021 marks noyb’s fourth year of fighting for the right to privacy. We have taken things up a notch by filing a record-breaking amount of complaints: noyb filed…
The European Commission faces a lawsuit over allegations it is violating its own data protection rules by transferring citizens’ personal data on one of its websites to Amazon Web…
The European Commission is to face a lawsuit over allegations it is violating its own data protection rules when transferring citizens' personal data from one of its websites to…
Europol has more possibilities to cooperate with third countries, including the possibility to exchange personal data with countries where sufficient guarantees exist. In…
€20 million fine for Clearview AI in Greece The Greek data protection authority has fined the company Clearview AI €20 million. The company that sells facial recognition software…
Data Transfers European DPAs get Facebook Data Transfer Decision by Irish DPC As the DPC informed journalists today, it issued a Draft Decision under Article 60 GDPR, concerning…
Data Transfers UPDATE: Further EU DPA orders stop of Google Analytics The Italian DPA (GPDP) has joined the consensus shared by the EDPS, as well as the French and Austrian DPA…
> The study shows that the clarity and accessibility of the UAVG are viewed critically. This is partly due to the “policy-neutral” interpretation of the law and the short…
The Italian Data Protection Authority reached this conclusion following a complex investigation, conducted in close cooperation with other European data protection authorities, in…
> The Italian SA came to this conclusion after a complex fact-finding exercise it had started in close coordination with other EU data protection authorities following complaints…
Forced Consent & Consent Bypass Sweden: Users are not party to their own privacy rights? The Swedish DPA (IMY) refuses to take a decision on a GDPR complaint, claiming that the…
Today, noyb filed an appeal against a decision of the Spanish DPA (AEPD) regarding the phone provider Virgin Telco. A customer made an access request to receive his location data…
The new data governance regulation sets out the conditions for the reuse of certain government data. In addition, the regulation provides a notification and oversight framework…
> European supervisory authorities’ varying practices of calculating GDPR administrative fines can be viewed, on the one hand, as inconsistent and in conflict with the principle…
The responsible official filmed the individual in their work environment and posted a 66-second video on YouTube for promotional purposes. The individual had previously given…