Data protection and digital regulation developments, collected automatically from 17+ sources.
Get this as an email digestThe Belgian SA fined a medical laboratory €20,000 for violating Articles 5(1)(f), 12, 13, 14, 24, 25, 32, 35(1), and 35(3) GDPR due to a lack of security and a privacy policy on…
> As part of its data strategy, the European Commission has presented a number of legislative instruments, including the Digital Markets Act (DMA), the Digital Services Act (DSA),…
The processing of personal data that may indirectly reveal sensitive information about an individual, such as information about their sexual orientation, may qualify as processing…
Cookie Banners Final round of “One Trust” cookie banners: 226 complaints lodged against deceptive cookie banners that are still not complying with GDPR requirements Today, noyb…
De voorgestelde boete volgt op klachten die de privacyorganisatie "Privacy International" heeft ingediend tegen Criteo. [...] In het kader van de sanctieprocedure van de CNIL…
> The proposed fine follows complaints filed by privacy NGO ‘Privacy International’ against Criteo. […] Under the CNIL’s sanction procedure, Criteo has the right to respond to the…
Op 21 juni 2022 heeft het Gerechtshof van de Europese Unie (Groot Beschouwingscollege) een baanbrekende uitspraak gedaan waarin het het EU-regime voor het verzamelen en gebruiken…
> In a landmark ruling of 21 June 2022, the CJEU (Grand Chamber), upheld the EU’s regime to collect and use records of travellers, provided that it is strictly interpreted in line…
Op 5 april 2022 voegde het Hof van Justitie van de Europese Unie (HvJ EU) een nieuw hoofdstuk toe aan de lange geschiedenis van de toelaatbaarheid van gegevensopslag binnen de EU.…
> On 5 April 2022, the CJEU added another chapter to the long history of the admissibility of data retention in the EU. In a case concerning the data retention law in Ireland, the…
De Europese Autoriteit voor gegevensbescherming (EDPB) en de Europese Toezichthouder op het gebied van gegevensbescherming (EDPS) hebben een gezamenlijk advies aangenomen over het…
> The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a Joint Opinion on the Proposal for a Regulation to prevent and combat child…
> A firehose of sensitive data from your vehicle is flowing to a group of companies you’ve probably never heard of
> Thirty study participants playtested an innocent-looking "escape room" game in virtual reality (VR). Behind the scenes, an adversarial program had accurately inferred over 25…
Annual Report 2021 2021 marks noyb’s fourth year of fighting for the right to privacy. We have taken things up a notch by filing a record-breaking amount of complaints: noyb filed…
The European Commission faces a lawsuit over allegations it is violating its own data protection rules by transferring citizens’ personal data on one of its websites to Amazon Web…
The European Commission is to face a lawsuit over allegations it is violating its own data protection rules when transferring citizens' personal data from one of its websites to…
Europol has more possibilities to cooperate with third countries, including the possibility to exchange personal data with countries where sufficient guarantees exist. In…
€20 million fine for Clearview AI in Greece The Greek data protection authority has fined the company Clearview AI €20 million. The company that sells facial recognition software…
Data Transfers European DPAs get Facebook Data Transfer Decision by Irish DPC As the DPC informed journalists today, it issued a Draft Decision under Article 60 GDPR, concerning…
Data Transfers UPDATE: Further EU DPA orders stop of Google Analytics The Italian DPA (GPDP) has joined the consensus shared by the EDPS, as well as the French and Austrian DPA…
> Het onderzoek laat zien dat de duidelijkheid en toegankelijkheid van de UAVG kritisch wordt beoordeeld. Mede de ‘beleidsneutrale’ invulling van de wet en de korte tijd waarin…
De Italiaanse autoriteit voor gegevensbescherming kwam tot deze conclusie na een complex onderzoek, dat werd uitgevoerd in nauwe samenwerking met andere Europese autoriteiten voor…
> The Italian SA came to this conclusion after a complex fact-finding exercise it had started in close coordination with other EU data protection authorities following complaints…
Forced Consent & Consent Bypass Sweden: Users are not party to their own privacy rights? The Swedish DPA (IMY) refuses to take a decision on a GDPR complaint, claiming that the…
Today, noyb filed an appeal against a decision of the Spanish DPA (AEPD) regarding the phone provider Virgin Telco. A customer made an access request to receive his location data…
The new data governance regulation sets out the conditions for the reuse of certain government data. In addition, the regulation provides a notification and oversight framework…
> European supervisory authorities’ varying practices of calculating GDPR administrative fines can be viewed, on the one hand, as inconsistent and in conflict with the principle…
De verantwoordelijke functionaris heeft de betrokkene gefilmd in hun werkomgeving en heeft een video van zesenzestig seconden op YouTube gepubliceerd voor promotionele doeleinden.…
GDPR did not change a culture of non-compliance. When the GDPR became applicable on 25 May 2018, it was perceived as a watershed moment. Comments were somewhere between the EU…
Data Transfers Open Letter on the Future of EU-US Data Transfers While many details are still unclear, more and more details about the planned EU-US data transfer deal have…
The proposed rules would require online service providers to detect, report and remove child sexual abuse material on their services. Those providers must also assess the risk of…
UPDATE on 101 complaints: Austrian DPA rejects “risk based approach” for data transfers to third countries After the groundbreaking decisions by the Austrian and French DPA that…
Political data breach in Malta: C-Planet refuses right to access and information Today, noyb filed a second complaint before the Information & Data Protection Commissioner (IDPC)…
An association representing consumer interests may bring a representative action against the alleged perpetrator of a personal data breach. A specific breach of a data subject's…
Forced Consent & Consent Bypass Irish DPC to pay tens of thousands in legal costs over 47 months delay in cases against WhatsApp and Instagram Today the Irish DPC has settled a…
Lawfully collected and stored personal data may be retained in an additional internal database, to the extent that it pursues the same data processing purposes as the original…
Data Transfers UPDATE: CNIL orders three controllers to comply with GDPR after decision that using Google Analytics is illegal Only weeks after the groundbreaking decision by the…
It is part of the exercise of judicial functions by a court within the meaning of the AVG to make documents originating from a judicial proceeding -in which personal data are…
Data Transfers "Privacy Shield 2.0"? - First Reaction by Max Schrems Today Commission President Ursula von der Leyen and President Biden have announced an "agreement in principle"…
In a cooperation between the worker’s union “UNI Global” and privacy NGO “noyb.eu”, Amazon warehouse workers from Germany, UK, Italy, Poland and Slovakia filed access requests…
€20 million fine for Clearview AI in Italy The Italian data protection authority has fined the company Clearview AI €20 million. The company that sells facial recognition software…
Cookie Banners Many more Cookie Banners to go: Second Wave of Complaints underway This week, noyb launched the second round of its action against deceptive cookie banners,…
The collection by the tax authority of a Member State of personal data concerning the advertisements for the sale of vehicles placed on the website of an economic operator falls…
Instead of only processing the payment, the German payment service "giropay" (formerly "paydirekt") keeps the information about each individual item purchased in online shops.…
> DeFine is a translation into a calculator of part of the methodology proposed by the European Data Protection Board to calculate GDPR fines (see EDPB, Guidelines 04/2022 on the…
Today's Data Protection Day marks the signing of the first pan-European data protection framework (Convention 108) in 1981. Fast-forward 41 years later, the GDPR has become the…
Following a complaint by noyb, the Information & Data Protection Commissioner (IDPC) imposed a fine of 65 000 € on the IT company C-Planet. The company had illegally collected…
Data Transfers Austrian DSB: Use of Google Analytics violates "Schrems II" decision by CJEU. In a groundbreaking decision, the Austrian Data Protection Authority…
Cookie Banners EDPS sanctions the European Parliament for illegal EU-US data transfers - among other violations The European Data Protection Supervisor (EDPS) issued a decision…
> Do we need an Chief Privacy Officer, a Data Protection Officer, or do we need both?In the following article, I will examine the benefits of both roles, but I will also look at…
GDPR complaint: Airbnb hosts at the mercy of algorithms Today, noyb.eu filed a GDPR complaint against Airbnb. The online market place for vacation rentals downgraded the…
Help! My recruiter is an algorithm! noyb has filed a complaint with the Luxembourg data protection authority (the CNPD) against Amazon because of their dubious e-recruiting…
Data Transfers Deep Dive: How to ignore the decisions of the CJEU in three steps. Facebook's Transfer Impact Assessment explained. For the privacy geeks, that want to know more…
Data Transfers 4th Advent Reading: Facebook's "Transfer Impact Assessment" fully ignores rulings by Court of Justice In the last "Advent Reading" in protest against the Irish…
Identification & Authentication NCC & noyb GDPR complaint: "Grindr" fined € 6.3 Mio over illegal data sharing Today, the Norwegian Data Protection Authority imposed a fine of 65…
noyb's third "Advent Reading": Facebook's laughable Record of Processing Activities (ROPA) In its third "Advent Reading" (in protest of the DPC unlawfully removing noyb from a…
ZDF Magazin Royale and noyb.eu ask for your data donation for democracy! Max Schrems in an interview in ZDF MAGAZIN ROYALE Link to the data donation page: targetleaks.noyb.eu…
noyb's Second "Advent Reading": How the Irish DPC tried to lobby Facebook's "GDPR bypass" into European Guidelines. This week, noyb published two rounds of documents as part of…
Data Transfers noyb's first "Advent Reading" from Facebook and DPC documents! Today we are glad to publish our first (still very improvised) advent reading from Facebook and DPC…
Irish DPC demanded noyb to sign a "non-disclosure agreement" or remove noyb from Facebook procedure. noyb files criminal report against DPC. The Irish Data Protection Commission…
Data protection authority finds traffic and location data from cell phones not "personal" - noyb appeals to federal administrative court In June 2020, noyb had filed a formal…
Identification & Authentication Want your Grindr data? Show your ID and take a selfie! Today, noyb filed a GDPR complaint against Grindr – a dating app for gay, bi, trans and…
"Black box" Amazon: algorithm discriminate customers noyb filed another complaint against Amazon Europe today. The e-commerce giant offers customers the possibility to pay for…
Credit Scoring Illegal credit scores: noyb to amplify pressure Today, noyb filed a complaint against the address trader Acxiom and the credit reference agency CRIF Bürgel in…
Forced Consent & Consent Bypass DPC sent "take down request" to noyb, after publishing a problematic Draft Decision stripping Facebook users of their rights under GDPR. Yesterday…
Forced Consent & Consent Bypass Irish DPC greenlights Facebook's "GDPR bypass". Schrems: “Decision undermines key element of GDPR.” Your browser does not support HTML5 videos.…
Irish DPC issued € 225 million fine against WhatsApp/Facebook Press Release by Irish DPC EDPB Decision (redacted) More Information in First Media Reports Statement by Max Schrems,…
In internal news: noyb is hiring lawyers and developers! Not only our workload, but also our team is growing bit by bit. We are happy to announce that we now looking for GDPR…
Cookie Banners News Sites: Readers need to "buy back" their own data at an exorbitant price Today, noyb filed complaints against the cookie paywalls of seven major German and…
Cookie Banners noyb files 422 formal GDPR complaints on nerve-wrecking “Cookie Banners” As part of a one-year project on "deceptive designs" and "dark patterns", noyb aims to…
Credit Scoring Data voodoo: Credit ranking agency CRIF creates creditworthiness out of thin air. Data protection authority also demands disclosure of "scoring" logic. After about…
BREAKING: Austrian Supreme Court asks CJEU if Facebook "undermines" the GDPR by confusing 'consent' with an alleged 'contract'. In a long-standing civil case between Max Schrems…
Forced Consent & Consent Bypass In January 2019 we filed complaints against eight streaming services for not responding properly to simple access requests. As one of the most…
Data Transfers Statement by Max Schrems a year after the "Schrems II" decision by the Court of Justice of the European Union A year ago the so-called "Schrems II" decison was…
Our third year of fighting for privacy: Annual Report 2020 out now Annual Report 2020 (EN) After successfully setting up our team, office and processes in the past years, 2020…
Cookie Banners New browser signal could make cookie banners obsolete Today, noyb and Sustainable Computig Lab ("CSL") published a proposal for a new automatic browser signal to…
Cookie Banners noyb aims to end “cookie banner terror” and issues more than 500 GDPR complaints Today, noyb.eu sent over 500 draft complaints to companies who use unlawful cookie…
Today, noyb and other EU digital rights organisations filed legal complaints to stop online mass surveillance by facial recognition company Clearview. Complaint filed to Austrian…
Three years ago, on 25 May 2018, the General Data Protection Regulation became applicable. The GDPR was meant to give rights to everyday people that are subject to data processing…
The European Parliament has adopted a resolution (Link) calling on the European Commission to start infringement procedures against Ireland, over the lack of GDPR enforcement.…
Data Transfers Decision by Irish High Court: DPC must now implement CJEU judgment and stop Facebook's EU-US data transfers. The High Court ruled today, that the Irish Data…
Data Transfers Google continues to send data from EU websites to the US - despite two Court of Justice rulings. Austrian Data Protection Authority could fine Google up to €6…
Irish DPC openly acknowledges: It does not decide about GDPR complaints. At least 99.93% see no decision, despite €19.1 million funding. In a rather astonishing hearing before the…
Online & Mobile tracking Buy a phone, get a tracker: unauthorized tracking code illegally installed on Android phones As reported by the Financial Times, noyb launched further…
Credit Scoring Illegal data exchange between address publisher and credit ranking agency noyb filed a GDPR complaint against the credit ranking agency CRIF GmbH and the address…
Data Transfers EU-US Transfers, a Parliamentary Resolution — and a Dramatic Exit. As the Irish Times and the Financial Times reported yesterday evening, a substantial fight…
Facebook's GDPR consent bypass via a "contractual advertisement duty" before Austrian Supreme Court, with high potential for a reference to the CJEU As the Austrian Press Agency…
Credit Scoring Right of access as a data protection boomerang? Credit reference agency collects data from people who request information On 08.02.2021, noyb filed a GDPR complaint…
Clearview AI’s biometric photo database deemed illegal in the EU, but only partial deletion ordered Clearview AI is a US company that scrapes photos from websites to create a…
This years European Data Protection Day on January 28th, marks the 40th anniversary of the signing of the European Data Protection Convention (Convention 108) on January 28th…
Identification & Authentication "Grindr" to be fined almost € 10 Mio over GDPR complaint. The Gay Dating App was illegally sharing sensitive data of millions of users. In January…
GDPR: A Law without Authority? Luxemburg’s Data Protection watchdog refuses to show its teeth to US companies. noyb files court caseToday, noyb filed an appeal against two…
Data transfers to the US and insufficient cookie information: noyb filed complaint on behalf of six MEPs against the European Parliament. Today, noyb filed a complaint against the…
Data Transfers Irish DPC settles Judicial Review and agrees to decide swiftly. Blocked procedure on Facebook's EU-US data flows can continue. The DPC has agreed with Max Schrems'…
The Viennese Superior Court (Oberlandesgericht Wien) has delivered a ruling today that Facebook must pay Mr Schrems € 500 in emotional damages and grant him full access to all the…
Data Transfers “Schrems II” reaches US Legislator: US Senate Hearing on EU-US data transfers today Today at 10:00am EST / 16:00 CET the Committee for Commerce, Science and…
Online & Mobile tracking noyb files complaints against Apple's tracking code "IDFA" IDFA (Apple’s Identifier for Advertisers) allows Apple and all apps on the phone to track a…
Data breach in Malta: complaint against C-Planet filed noyb has filed a complaint against C-Planet IT Solutions, the company responsible for the leaked database of voter’s data in…
In September, the Belgian Official Journal published a Ministerial Decree approving noyb as a qualified entity under the collective action scheme of the Belgian Code of Economic…
Your browser does not support the video tag. This week we reached the first 3,000 subscribers for our GDPR expert newsletter: GDPRtoday! Within only 10 months our project GDPRhub…
Data Transfers DPC ordered to pick up most of the legal bill of EU-US data transfer case Today, the Irish High Court has ordered the DPC to cover the costs of Mr Schrems’ legal…
Data Subject Rights Wizz Air: €1 for a flight, €35 for your GDPR right On 21.10.2020 noyb filed a GDPR complaint against Central and Eastern Europe’s Largest Low Cost Airline,…
On Tuesday, noyb filed a GDPR complaint against the Vienna-based address broker AZ Direct Österreich GmbH. The company, which belongs to the Bertelsmann group, had refused to…
Data Transfers Irish High Court allows Judicial Review aiming to stop Facebook’s EU-US Data Transfers The Irish High Court has granted leave for a “Judicial Review” against the…
Data Transfers Opening Pandora’s Box: Companies can't say how they comply with CJEU ruling Following the Court’s judgment in Case-C-311/18 (“Schrems II”) on the Privacy Shield and…
Data Transfers Just over a month ago, noyb filed 101 complaints against several companies based in the EU/EEA because they continue to use Google Analytics and Facebook Connect on…
Forced Consent & Consent Bypass First decision on noyb’s streaming complaints - after more than one and a half years In cooperation with the Austrian Chamber of Labour, noyb filed…
Data Transfers Today at about 15:00 BST (16:00 CET) the Irish High Court has granted Facebook leave to file a Judicial Review against the DPC (Case No 2020/617 JR) and stayed a…
Data Transfers Is the DPC actually stopping Facebook's EU-US data transfers?! ..maybe half-way! The WSJ reported on Wednesday night that the Irish Data Protection Commission…
Annual Report for 2018 and 2019 noyb has started at the turn of 2017 to 2018 with a bold vision: to establish a European non-profit that works on strategic litigation to ensure…
Data Transfers Watch the full length video here: On September 3rd, our honorary chairman, Max Schrems, participated in a hearing of the European Parliament to discuss the judgment…
Data Transfers A quick analysis of the HTML source code of major EU webpages shows that many companies still use Google Analytics or Facebook Connect one month after a major…
Credit Scoring noyb.eu filed a GDPR complaint against the credit rating agency "CRIF", who is active in over 28 countries. CRIF assigned a "score" of exactly 446 out of 700…
Data Transfers Following the CJEU's judgment on EU-US data transfers by Facebook, we requested that the Irish DPC take action. The DPC's first response indicates that it is…
Data Transfers On this page we have summarized the options for users that want to stop their data being transferred to the United States after the CJEU judgment in C-311/18…
Your browser does not support the video tag. We are fully aware that many controllers are overwhelmed with the recent judgment by the CJEU on EU-US data transfers and the lack of…
Data Transfers CJEU invalidates “Privacy Shield” in US Surveillance case. SCCs cannot be used by Facebook and similar companies. Facebook and similar companies may also not use…
The CJEU received eleven questions submitted by the Irish High Court. The CJEU was free to reformulate the questions and address only some of them. This FAQ gives a simple…
Forced Consent & Consent Bypass In the complaints procedures concerning WhatsApp and Instagram, both based in Ireland, the Irish Data Protection Commission (DPC) has taken 2 years…