Data protection and digital regulation developments, collected automatically from 17+ sources.
Get this as an email digestGDPR did not change a culture of non-compliance. When the GDPR became applicable on 25 May 2018, it was perceived as a watershed moment. Comments were somewhere between the EU…
Data Transfers Open Letter on the Future of EU-US Data Transfers While many details are still unclear, more and more details about the planned EU-US data transfer deal have…
The proposed rules would require online service providers to detect, report and remove child sexual abuse material on their services. Those providers must also assess the risk of…
UPDATE on 101 complaints: Austrian DPA rejects “risk based approach” for data transfers to third countries After the groundbreaking decisions by the Austrian and French DPA that…
Political data breach in Malta: C-Planet refuses right to access and information Today, noyb filed a second complaint before the Information & Data Protection Commissioner (IDPC)…
An association representing consumer interests may bring a representative action against the alleged perpetrator of a personal data breach. A specific breach of a data subject's…
Forced Consent & Consent Bypass Irish DPC to pay tens of thousands in legal costs over 47 months delay in cases against WhatsApp and Instagram Today the Irish DPC has settled a…
Lawfully collected and stored personal data may be retained in an additional internal database, to the extent that it pursues the same data processing purposes as the original…
Data Transfers UPDATE: CNIL orders three controllers to comply with GDPR after decision that using Google Analytics is illegal Only weeks after the groundbreaking decision by the…
It is part of the exercise of judicial functions by a court within the meaning of the AVG to make documents originating from a judicial proceeding -in which personal data are…
Data Transfers "Privacy Shield 2.0"? - First Reaction by Max Schrems Today Commission President Ursula von der Leyen and President Biden have announced an "agreement in principle"…
In a cooperation between the worker’s union “UNI Global” and privacy NGO “noyb.eu”, Amazon warehouse workers from Germany, UK, Italy, Poland and Slovakia filed access requests…
€20 million fine for Clearview AI in Italy The Italian data protection authority has fined the company Clearview AI €20 million. The company that sells facial recognition software…
Cookie Banners Many more Cookie Banners to go: Second Wave of Complaints underway This week, noyb launched the second round of its action against deceptive cookie banners,…
The collection by the tax authority of a Member State of personal data concerning the advertisements for the sale of vehicles placed on the website of an economic operator falls…
Instead of only processing the payment, the German payment service "giropay" (formerly "paydirekt") keeps the information about each individual item purchased in online shops.…
> DeFine is a translation into a calculator of part of the methodology proposed by the European Data Protection Board to calculate GDPR fines (see EDPB, Guidelines 04/2022 on the…
Today's Data Protection Day marks the signing of the first pan-European data protection framework (Convention 108) in 1981. Fast-forward 41 years later, the GDPR has become the…
Following a complaint by noyb, the Information & Data Protection Commissioner (IDPC) imposed a fine of 65 000 € on the IT company C-Planet. The company had illegally collected…
Data Transfers Austrian DSB: Use of Google Analytics violates "Schrems II" decision by CJEU. In a groundbreaking decision, the Austrian Data Protection Authority…
Cookie Banners EDPS sanctions the European Parliament for illegal EU-US data transfers - among other violations The European Data Protection Supervisor (EDPS) issued a decision…
> Do we need an Chief Privacy Officer, a Data Protection Officer, or do we need both?In the following article, I will examine the benefits of both roles, but I will also look at…
GDPR complaint: Airbnb hosts at the mercy of algorithms Today, noyb.eu filed a GDPR complaint against Airbnb. The online market place for vacation rentals downgraded the…
Help! My recruiter is an algorithm! noyb has filed a complaint with the Luxembourg data protection authority (the CNPD) against Amazon because of their dubious e-recruiting…
Data Transfers Deep Dive: How to ignore the decisions of the CJEU in three steps. Facebook's Transfer Impact Assessment explained. For the privacy geeks, that want to know more…
Data Transfers 4th Advent Reading: Facebook's "Transfer Impact Assessment" fully ignores rulings by Court of Justice In the last "Advent Reading" in protest against the Irish…
Identification & Authentication NCC & noyb GDPR complaint: "Grindr" fined € 6.3 Mio over illegal data sharing Today, the Norwegian Data Protection Authority imposed a fine of 65…
noyb's third "Advent Reading": Facebook's laughable Record of Processing Activities (ROPA) In its third "Advent Reading" (in protest of the DPC unlawfully removing noyb from a…
ZDF Magazin Royale and noyb.eu ask for your data donation for democracy! Max Schrems in an interview in ZDF MAGAZIN ROYALE Link to the data donation page: targetleaks.noyb.eu…
noyb's Second "Advent Reading": How the Irish DPC tried to lobby Facebook's "GDPR bypass" into European Guidelines. This week, noyb published two rounds of documents as part of…
Data Transfers noyb's first "Advent Reading" from Facebook and DPC documents! Today we are glad to publish our first (still very improvised) advent reading from Facebook and DPC…
Irish DPC demanded noyb to sign a "non-disclosure agreement" or remove noyb from Facebook procedure. noyb files criminal report against DPC. The Irish Data Protection Commission…
Data protection authority finds traffic and location data from cell phones not "personal" - noyb appeals to federal administrative court In June 2020, noyb had filed a formal…
Identification & Authentication Want your Grindr data? Show your ID and take a selfie! Today, noyb filed a GDPR complaint against Grindr – a dating app for gay, bi, trans and…
"Black box" Amazon: algorithm discriminate customers noyb filed another complaint against Amazon Europe today. The e-commerce giant offers customers the possibility to pay for…
Credit Scoring Illegal credit scores: noyb to amplify pressure Today, noyb filed a complaint against the address trader Acxiom and the credit reference agency CRIF Bürgel in…
Forced Consent & Consent Bypass DPC sent "take down request" to noyb, after publishing a problematic Draft Decision stripping Facebook users of their rights under GDPR. Yesterday…
Forced Consent & Consent Bypass Irish DPC greenlights Facebook's "GDPR bypass". Schrems: “Decision undermines key element of GDPR.” Your browser does not support HTML5 videos.…
Irish DPC issued € 225 million fine against WhatsApp/Facebook Press Release by Irish DPC EDPB Decision (redacted) More Information in First Media Reports Statement by Max Schrems,…
In internal news: noyb is hiring lawyers and developers! Not only our workload, but also our team is growing bit by bit. We are happy to announce that we now looking for GDPR…
Cookie Banners News Sites: Readers need to "buy back" their own data at an exorbitant price Today, noyb filed complaints against the cookie paywalls of seven major German and…
Cookie Banners noyb files 422 formal GDPR complaints on nerve-wrecking “Cookie Banners” As part of a one-year project on "deceptive designs" and "dark patterns", noyb aims to…
Credit Scoring Data voodoo: Credit ranking agency CRIF creates creditworthiness out of thin air. Data protection authority also demands disclosure of "scoring" logic. After about…
BREAKING: Austrian Supreme Court asks CJEU if Facebook "undermines" the GDPR by confusing 'consent' with an alleged 'contract'. In a long-standing civil case between Max Schrems…
Forced Consent & Consent Bypass In January 2019 we filed complaints against eight streaming services for not responding properly to simple access requests. As one of the most…
Data Transfers Statement by Max Schrems a year after the "Schrems II" decision by the Court of Justice of the European Union A year ago the so-called "Schrems II" decison was…
Our third year of fighting for privacy: Annual Report 2020 out now Annual Report 2020 (EN) After successfully setting up our team, office and processes in the past years, 2020…
Cookie Banners New browser signal could make cookie banners obsolete Today, noyb and Sustainable Computig Lab ("CSL") published a proposal for a new automatic browser signal to…
Cookie Banners noyb aims to end “cookie banner terror” and issues more than 500 GDPR complaints Today, noyb.eu sent over 500 draft complaints to companies who use unlawful cookie…
Today, noyb and other EU digital rights organisations filed legal complaints to stop online mass surveillance by facial recognition company Clearview. Complaint filed to Austrian…
Three years ago, on 25 May 2018, the General Data Protection Regulation became applicable. The GDPR was meant to give rights to everyday people that are subject to data processing…
The European Parliament has adopted a resolution (Link) calling on the European Commission to start infringement procedures against Ireland, over the lack of GDPR enforcement.…
Data Transfers Decision by Irish High Court: DPC must now implement CJEU judgment and stop Facebook's EU-US data transfers. The High Court ruled today, that the Irish Data…
Data Transfers Google continues to send data from EU websites to the US - despite two Court of Justice rulings. Austrian Data Protection Authority could fine Google up to €6…
Irish DPC openly acknowledges: It does not decide about GDPR complaints. At least 99.93% see no decision, despite €19.1 million funding. In a rather astonishing hearing before the…
Online & Mobile tracking Buy a phone, get a tracker: unauthorized tracking code illegally installed on Android phones As reported by the Financial Times, noyb launched further…
Credit Scoring Illegal data exchange between address publisher and credit ranking agency noyb filed a GDPR complaint against the credit ranking agency CRIF GmbH and the address…
Data Transfers EU-US Transfers, a Parliamentary Resolution — and a Dramatic Exit. As the Irish Times and the Financial Times reported yesterday evening, a substantial fight…
Facebook's GDPR consent bypass via a "contractual advertisement duty" before Austrian Supreme Court, with high potential for a reference to the CJEU As the Austrian Press Agency…
Credit Scoring Right of access as a data protection boomerang? Credit reference agency collects data from people who request information On 08.02.2021, noyb filed a GDPR complaint…
Clearview AI’s biometric photo database deemed illegal in the EU, but only partial deletion ordered Clearview AI is a US company that scrapes photos from websites to create a…
This years European Data Protection Day on January 28th, marks the 40th anniversary of the signing of the European Data Protection Convention (Convention 108) on January 28th…
Identification & Authentication "Grindr" to be fined almost € 10 Mio over GDPR complaint. The Gay Dating App was illegally sharing sensitive data of millions of users. In January…
GDPR: A Law without Authority? Luxemburg’s Data Protection watchdog refuses to show its teeth to US companies. noyb files court caseToday, noyb filed an appeal against two…
Data transfers to the US and insufficient cookie information: noyb filed complaint on behalf of six MEPs against the European Parliament. Today, noyb filed a complaint against the…
Data Transfers Irish DPC settles Judicial Review and agrees to decide swiftly. Blocked procedure on Facebook's EU-US data flows can continue. The DPC has agreed with Max Schrems'…
The Viennese Superior Court (Oberlandesgericht Wien) has delivered a ruling today that Facebook must pay Mr Schrems € 500 in emotional damages and grant him full access to all the…
Data Transfers “Schrems II” reaches US Legislator: US Senate Hearing on EU-US data transfers today Today at 10:00am EST / 16:00 CET the Committee for Commerce, Science and…
Online & Mobile tracking noyb files complaints against Apple's tracking code "IDFA" IDFA (Apple’s Identifier for Advertisers) allows Apple and all apps on the phone to track a…
Data breach in Malta: complaint against C-Planet filed noyb has filed a complaint against C-Planet IT Solutions, the company responsible for the leaked database of voter’s data in…
Data Transfers DPC ordered to pick up most of the legal bill of EU-US data transfer case Today, the Irish High Court has ordered the DPC to cover the costs of Mr Schrems’ legal…
Your browser does not support the video tag. This week we reached the first 3,000 subscribers for our GDPR expert newsletter: GDPRtoday! Within only 10 months our project GDPRhub…
In September, the Belgian Official Journal published a Ministerial Decree approving noyb as a qualified entity under the collective action scheme of the Belgian Code of Economic…
Data Subject Rights Wizz Air: €1 for a flight, €35 for your GDPR right On 21.10.2020 noyb filed a GDPR complaint against Central and Eastern Europe’s Largest Low Cost Airline,…
On Tuesday, noyb filed a GDPR complaint against the Vienna-based address broker AZ Direct Österreich GmbH. The company, which belongs to the Bertelsmann group, had refused to…
Data Transfers Irish High Court allows Judicial Review aiming to stop Facebook’s EU-US Data Transfers The Irish High Court has granted leave for a “Judicial Review” against the…
Data Transfers Opening Pandora’s Box: Companies can't say how they comply with CJEU ruling Following the Court’s judgment in Case-C-311/18 (“Schrems II”) on the Privacy Shield and…
Data Transfers Just over a month ago, noyb filed 101 complaints against several companies based in the EU/EEA because they continue to use Google Analytics and Facebook Connect on…
Forced Consent & Consent Bypass First decision on noyb’s streaming complaints - after more than one and a half years In cooperation with the Austrian Chamber of Labour, noyb filed…
Data Transfers Today at about 15:00 BST (16:00 CET) the Irish High Court has granted Facebook leave to file a Judicial Review against the DPC (Case No 2020/617 JR) and stayed a…
Data Transfers Is the DPC actually stopping Facebook's EU-US data transfers?! ..maybe half-way! The WSJ reported on Wednesday night that the Irish Data Protection Commission…
Annual Report for 2018 and 2019 noyb has started at the turn of 2017 to 2018 with a bold vision: to establish a European non-profit that works on strategic litigation to ensure…
Data Transfers Watch the full length video here: On September 3rd, our honorary chairman, Max Schrems, participated in a hearing of the European Parliament to discuss the judgment…
Data Transfers A quick analysis of the HTML source code of major EU webpages shows that many companies still use Google Analytics or Facebook Connect one month after a major…
Credit Scoring noyb.eu filed a GDPR complaint against the credit rating agency "CRIF", who is active in over 28 countries. CRIF assigned a "score" of exactly 446 out of 700…
Data Transfers Following the CJEU's judgment on EU-US data transfers by Facebook, we requested that the Irish DPC take action. The DPC's first response indicates that it is…
Data Transfers On this page we have summarized the options for users that want to stop their data being transferred to the United States after the CJEU judgment in C-311/18…
Your browser does not support the video tag. We are fully aware that many controllers are overwhelmed with the recent judgment by the CJEU on EU-US data transfers and the lack of…
Data Transfers CJEU invalidates “Privacy Shield” in US Surveillance case. SCCs cannot be used by Facebook and similar companies. Facebook and similar companies may also not use…
The CJEU received eleven questions submitted by the Irish High Court. The CJEU was free to reformulate the questions and address only some of them. This FAQ gives a simple…
Forced Consent & Consent Bypass In the complaints procedures concerning WhatsApp and Instagram, both based in Ireland, the Irish Data Protection Commission (DPC) has taken 2 years…
A judge of the Vienna Regional Court delivered a written judgment (PDF, German) in a long-lasting civil case on Facebook yesterday night. Despite summarizing detailed facts about…
In May, we published an open letter describing the Irish DPA’s (DPC) “Kafkaesque” procedure for its handling of the Facebook case. The Facebook Group could face a fine of up to €…
Forced Consent & Consent Bypass Background. Following a complaint by noyb and a similar complaint by the French NGO “La Quadrature du Net” the CNIL (the French Data Protection…
noyb.eu filed a GDPR complaint against A1 Telekom Austria on Friday, as A1 refuses to provide traffic and location data to its customers. Since A1 also uses this data for movement…
After a massive leak of the voter’s list showing the voting preferences, addresses, phone numbers and dates of birth of a majority of the Maltese population, noyb.eu will assist…
Within hours of the new GDPR being applicable on 25 May 2018, the European non-profit organisation noyb.eu filed three complaints against the Facebook Group (including WhatsApp…
After lack of reaction: former Apple employee presents letter to DPAs, asking them to investigate Siri recording the users. noyb.eu will be looking into the case. We generally…
Online & Mobile tracking Today noyb.eu filed a formal GDPR complaint against Google for tracking users through an “Android Advertising ID” without a valid legal basis. The data…
Austria: First European "corona app" with 400,000 active users reviewed by noyb, epicenter.works and SBA resarch. Privacy friendly concept, that can still be improved. Download…
In recent days, the discussions around the use of data to combat the corona pandemic have increased. Therefore, we have written an ad hoc paper v0.3 (PDF, English) on compliance…
The outbreak of the SARS-CoV-2 pandemic has forced many people to work from home. Video conferencing tools and other remote means of communication make this possible, transforming…
Forced Consent & Consent Bypass Cinemas and theatres are closed but the show must go on, as they say. And the show does go on. There is TV, of course, but also streaming services…
Data Security Baseline email security missing. During their route to the recipient, emails are handled by different entities, nodes and service providers which may intercept,…
The content on GDPRhub is divided into two databases: decisions and knowledge. In the decisions section we collect summaries of decisions by national DPAs and courts in English.…
After more than 9 hours, the Vienna Regional Court for Civil Matters (LGfZRS) closed the oral hearing in the data protection case against Facebook. The judgement will be issued in…
Identification & Authentication Link to the main page of the Norwegian Consumer Council: https://www.forbrukerradet.no/out-of-control/ Research by the Norwegian Consumer Council…
Data Transfers Data Protection Authorities must stop data transfers if Fundamental Rights are violated. Serious doubts over Privacy Shield. Advocate General applies ECHR instead…
Data Transfers In preparation of the delivery of the non-binding advisory opinion of the Advocate General on December 19th at about 9:45 in Luxemburg, we have compiled the…
Cookie Banners Cookie banners of large French webpages turn a clear “NO” into “fake consent” noyb.eu files three GDPR complaints with the French Data Protection Regulator (CNIL).…
The world’s largest social network believes it has found a way to bypass Europe’s strict privacy laws. In yesterday’s proceedings before the Vienna Regional Court (Landesgericht…
Download: Press Release Due to a number of requests, we have summarized the key facts of the case before the Court of Justice of the European Union (CJEU) on EU-US data transfers…
Key Info The French data protection authority (CNIL) just has announced that it has imposed a record fine of € 50 million on Google for violating the GDPR today (Link) The penalty…
The Austrian Supreme Court has ultimately rejected all attempts by Facebook to block a model lawsuit on fundamental privacy issues in Vienna now. In the final decision (link), the…
noyb and Access Now jointly hosted the workshop “One year after GDPR: Advancing rights through effective enforcement actions” from May 8 to 10 in Vienna. The workshop aimed to…
In the ongoing procedure on Facebook’s involvement with the NSA under the so-called “PRISM” surveillance program before the Irish Data Protection Commission (DPC) and the Irish…
Data Subject Rights Quick Links:Complaint AmazonComplaint AppleMusicComplaint DAZNComplaint FlimmitComplaint NetflixComplaint SoundCloudComplaint SpotifyComplaint YouTubeRight to…
Guest commentary by Max Schrems in ‘Der Standard’ (an Austrian newspaper) to the subscription type ‘PUR-Abo’ by DerStandard.at ‘Would you like to have a bit more privacy? – Then…
Many controllers reacted to GDPR with automated systems. While this may be effective and helpful in many cases, there is a tendency that controllers limit the options of data…
On November 11th, 2018 our director Max Schrems was on 60Minutes (the Sunday night TV program on CBS), trying to explain the good and the bad of GDPR and how we try to enforce it…