Data protection and digital regulation developments, collected automatically from 17+ sources.
Get this as an email digestWhen the GDPR came into force in 2018, the new and shiny data protection law was hailed as a shift towards stricter enforcement – ensuring that in the EU, the fundamental right to…
Forced Consent & Consent Bypass Since the beginning of November, Instagram and Facebook users who don’t want to be tracked have to pay a “privacy fee” of up to € 251.88 per year.…
Credit Scoring Today, noyb filed a complaint and report against the creditors’ association KSV1870 with the Austrian data protection authority. Although Article 15 GDPR stipulates…
BfDI für freie und vertrauenswürdige globale Datenverkehre
Political Microtargeting, Manipulation & Tracking Today, noyb filed a complaint against X (Twitter) for unlawfully using the political views and religious beliefs of its users for…
Credit Scoring Note: The judgments are not connected to noyb cases CJEU landmark rulings on “credit ranking” and review of DPAs The European Court of Justice (CJEU) today issued…
Credit Scoring noyb has filed a lawsuit against the credit reference agency CRIF GmbH and the address trader AZ Direct. The companies secretly trade the address data of almost…
Forced Consent & Consent Bypass Today, noyb filed a complaint against Meta with the Austrian data protection authority. European users now have the “choice” to either consent to…
BfDI kritisiert Nachrichtendienstgesetze
Political Microtargeting, Manipulation & Tracking noyb files complaint against EU Commission over targeted chat control ad campaign Today, noyb filed a complaint against the EU…
IFK fordert einheitlich hohes Transparenzniveau in Bund und Ländern
Credit Scoring Address trader sues German DPA to prevent noyb from accessing files Two years ago, noyb filed a complaint against the address trader Acxiom and the credit reference…
BfDI kritisiert Entwurf des Finanzkriminalitätsbekämpfungsgesetzes
Berlin Group beschließt Arbeitspapier zu Telemetrie
Data Subject Rights Streaming service DAZN took almost five years to answer a simple access request In January 2019, noyb filed two complaints against the streaming service DAZN…
Forced Consent & Consent Bypass Meta (Facebook / Instagram) to move to a "Pay for your Rights" approach The Wall Street Journal reported that Meta plans to move to a "Pay for your…
Online & Mobile tracking € 5,8 million fine for Grindr – appeal by Grindr failed In 2020, the Norwegian Consumer Council (NCC) filed a complaint to the Norwegian Data Protection…
BfDI kritisiert Gesetz zum Einsatz automatisierter Systeme bei der FIU
BfDI für effektivere Regeln zur Durchsetzung der DSGVO bei grenzüberschreitenden Sachverhalten
Forced Consent & Consent Bypass Today, noyb filed three complaints in France against Fnac (the largest electronics store in France), the real estate app SeLoger and the fitness…
Berlin Group beschließt Arbeitspapier zu “Smart Cities"
Forced Consent & Consent Bypass Today, noyb filed three complaints against Fitbit in Austria, the Netherlands and in Italy. The popular health and fitness company, acquired by…
Annual Report 2022 In 2022, noyb continued its longstanding fight for users’ right to privacy. Although the GDPR always foresaw a strong role for non-profits in this regard, we…
Data Transfers 23 years of illegal data transfers due to inactive DPAs and new EU-US deals In two landmark rulings in 2015 and 2020, the Court of Justice of the European Union…
Forced Consent & Consent Bypass Meta apparently switches to consent for behavioral ads after five years of litigation After more than five years of extensive litigation by noyb,…
Biometric Data Today, noyb filed a complaint against Ryanair. When booking through an online travel agent and not directly on its website or app, Europe’s biggest airline requires…
Cookie Banners Unlawful Cookie Banners: Belgian DPA let news outlets buy themselves free from GDPR compliance Belgian news outlets relying on illegal cookie banners paid € 10.000…
Forced Consent & Consent Bypass Norwegian DPA temporarily bans behavioral advertising on Facebook and Instagram Following a CJEU ruling that declared Meta/Facebook’s GDPR approach…
Cookie Banners „Pay or Okay“ on tech news site heise.de illegal, decides German DPA. Major implications for many other German news pages. One of the largest German-language tech…
Data Transfers Open letter: Repeated false allegations of a “business model” when citizens exercise their rights Instead of focusing on the legal matters of the supposedly new…
Data Transfers New Trans-Atlantic Data Privacy Framework largely a copy of "Privacy Shield". noyb will challenge the decision. Third attempt of the European Commission to get a…
The GDPR allows for six legal bases to process personal data. In the case Meta v Bundeskartellamt, the CJEU has today ruled on all of them - further clarifying the interpretation…
National Administrative Procedures and DPA inactivity GDPR Procedures Regulation: Commission Proposal is an attack on users' rights in GDPR procedures Today the EU Justice…
BfDI begrüßt die Meta-Entscheidung des EuGH
Data Transfers noyb win: First major fine (€ 1 million) for using Google Analytics Following noyb’s 101 complaints on unlawful EU-US data transfers, the Swedish data protection…
Ireland makes questionable GDPR cases 'confidential'. Irish DPC will likely use Section 26A to muzzle criticism. Despite profound criticism by civil society (ICCL, Amnesty, EDRi,…
National Administrative Procedures and DPA inactivity Ireland: Reporting about DPC procedures soon a crime! Irish Parliament can stop last-minute "gag order" amendment. In a…
Profiling & Automated Decision Making Today, noyb filed a complaint against TeleSign, a US company which profiled millions of phone users. TeleSign generates a “reputation score”…
Data Subject Rights The French Data Protection Authority (CNIL) fined Criteo, a major online advertisement and tracking company in Europe, €40 million for violating the GDPR. This…
IFK fordert zeitgemäßes Bundespressegesetz
Data Subject Rights Following a noyb complaint and litigation over inactivity, the Swedish Data Protection Authoirty (IMY) has issued a fine of 58 Mln Swedish Crown (about € 5…
Gemeinsame Pressemitteilung – Einheitliche Regeln für Datenschutzbußgelder in Europa
Credit Scoring noyb's legal proceedings against the credit reporting agency CRIF are uncovering a multitude of legal violations and cynical interpretations of the GDPR, exposing a…
BfDI zieht positives Fazit zu 5 Jahren DSGVO
5 Jahre DSGVO - Datenschutz-Grundverordnung als Maßstab in der digitalen Landschaft
. 85% of noyb cases not decided.On 25 May 2018, the GDPR came into force. While the contents of EU data protection rules stayed largely the same, the alleged big change was the…
The publication of its activity report enables the CNIL to report on its actions with regard to its four major missions: inform and protect the general public, accompany and…
Data Transfers Today, a decade-long (2013 - 2023) case on Meta's involvement in US mass surveillance has lead to a first direct decision. Meta must stop any further transfers of…
Political Microtargeting, Manipulation & Tracking Data Breach in Malta: Company must disclose source within 20 days or face penalties The Maltese Data Protection Authority (IDPC)…
Background information Following a complaint by the PRIVACY INTERNATIONAL association, the CNIL carried out four investigations into DOCTISSIMO. The doctissimo.fr website mainly…
The main thing is: The CNIL has been undertaking work for several years to anticipate and respond to the issues raised by AI. In 2023, it will extend its action on augmented…
Aankoop. Schadeclaim tegen de opdrachtgever. De beroepsmogelijkheid op het beginsel van estoppel wordt erkend. De eiser heeft de beslissing van de aanbesteding niet binnen 20…
> Procurement. Claim for damages against contracting authority. Reliance on estoppel succeeds. Plaintiff did not challenge the award decision in interlocutory proceedings within…
Verzoek om vrijgave van broncode. Gebruikskosten. Onrechtmatige verwijdering van broncode?
> Claim for release of source code. Use fee. Unlawful removal of source code? (Machine translated)
De schadelijke gevolgen van zogenaamde kunstmatige intelligentie zijn reëel en actueel, en zijn het gevolg van de handelingen van mensen en bedrijven die geautomatiseerde systemen…
> The harms from so-called AI are real and present and follow from the acts of people and corporations deploying automated systems. Regulatory efforts should focus on…
Ontbinding van het dienstverband als gevolg van een verstoorde arbeidsrelatie, ernstige schuld van de werkgever vanwege onvoldoende begeleiding bij de eerste poging tot…
> Dissolution because of a disturbed employment relationship, serious culpability of the employer because of insufficient reintegration in the first track and justified complaints…
On December 1, 2020, a cyberattack occurred at the municipality, during which the municipality's network and backup systems were encrypted and rendered inaccessible, and many…
> On December 1, 2020, a cyber attack took place at the municipality, encrypting and making inaccessible the municipality's network and backup systems and deleting many virtual…
The Austrian data protection authority has decided: Clearview AI, the company that sells facial recognition software to law enforcement agencies in the U.S. is no longer allowed…
Background information CLEARVIEW AI collects photos from a wide range of websites, including social networks, and sells access to its database of images of individuals via a…
Background information CLEARVIEW AI collects photographs from a wide range of websites, including social networks, and sells access to its database of images of people through a…
, contrary to national courts. Today, the Court of Justice of the European Union (CJEU) issued the first judgment on emotional damages under the GDPR, confirming that the GDPR…
noyb wins at the CJEU: Right to information must include context - in some cases also documents and database excerpts Yesterday, the Court of Justice of the European Union (CJEU)…
Camera-observatie van schadelijke uitstoot bij de verwerkingsinstallatie van Tata Steel is niet illegaal. Er wordt gesproken over effectieve observatie die niet gericht is op…
Camera surveillance of harmful emissions at Tata Steel's cooking plant is not unlawful. Spoken of effective surveillance that is not directed at individuals. Very low likelihood…
Cassatie in het belang van de rechtsorde. Openbaarheid van civiele procedures. Zijn rechtbanken verplicht om aan derden informatie te verstrekken over civiele procedures die lopen…
Cassation in the interest of the law. Disclosure of civil proceedings. Are courts required to disclose to others than parties information about civil proceedings that are or have…
Na de invoering van de EU-richtlijn inzake klokkenluiders in 2021, kregen de functionarissen voor gegevensbescherming van bedrijven de taak om veilige meldingskanalen op te…
> Following the implementation of the EU Whistleblower Directive in 2021, companies' data protection officers were tasked with setting up secure reporting channels. As these data…
Vonnis opgesteld door: Diederik Stols, Hanna van Til en Otto Volgenant, Boekx Advocaten. Rechterlijke Macht Amsterdam, 12 april 2023, IEF 21357; ECLI:NL:RBAMS:2023:2192 (EOKM v.…
Judgment submitted by: Diederik Stols, Hanna van Til, and Otto Volgenant, Boekx AdvocatenRb. Amsterdam April 12, 2023, IEF 21357; ECLI:NL:RBAMS:2023:2192 (EOKM v. Hammy Media) The…
Pornographic websites must demonstrate that persons who are identifiable in images that have not been professionally produced have given their consent for the disclosure of their…
Porn website must be able to prove that individuals who are recognizable in images in non-professionally created footage have given their consent to disclosure.
Cookie Banners "Pay or Okay" - the beginning of the end? "PUR Abo" on derStandard.at illegal according to Austrian DPA After the GDPR came into force, the Austrian daily newspaper…
Request by drivers to Ola Netherlands BV for access as referred to in Article 15 (1) AVG to certain personal data concerning them (including "ratings" given by passengers) and for…
ECJ EU, 30 maart 2023, IT 4246; ECLI:EU:C:2023:270 (Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v. Minister des Hessischen Kultusministeriums).…
ECJ EU March 30, 2023, IT 4246; ECLI:EU:C:2023:270 (Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v. Minister des Hessischen Kultusministeriums)…
Verzoek van Uber-chauffeurs aan Uber voor toegang tot bepaalde persoonsgegevens die betrekking hebben op hen (waaronder "beoordelingen" gegeven door passagiers), zoals bedoeld in…
Request from Uber drivers to Uber for access as referred to in Article 15 (1) AVG to certain personal data concerning them (including "ratings" given by passengers) and for…
Request from Uber drivers to Uber for information pursuant to Article 15(1)(h) GDPR (information on the existence of automated decision-making within the meaning of Article 22…
Request from Uber drivers to Uber for information under Article 15(1)(h) AVG (information about the existence of automated decision-making within the meaning of Article 22 AVG)…
The Netherlands Court of Audit has sent a letter to the House of Representatives highlighting bottlenecks in the implementation of the General Data Protection Regulation (GDPR) in…
The Court of Audit has sent a letter to the House of Representatives pointing out obstacles in the implementation of the General Data Protection Regulation (AVG) in the…
De eiser streeft er onder meer naar om een vermelding in het register van fraudegevallen van de SFH (een organisatie) te laten verwijderen, een vermelding die door de gedaagde…
Among other things, plaintiff seeks reversal of a listing on the SFH's fraud register by defendant (a mortgage lender) for fictitious employment. The court held that the defendant…
> No nonsense, just an opt-out: a free tool from noyb allowing you to object to Facebook quickly and easily! Use the noyb tool to opt out of targeted advertising and various other…
> No bullsh*t opt-out: free noyb tool for quick and broad Facebook objections! Use the noyb tool to opt out of targeted advertising and various other claimed 'legitimate…
Forced Consent & Consent Bypass No bullsh*t opt-out: Free noyb tool for quick and broad Facebook objections is now online! As reported last week, Meta switched the legal basis for…
Forced Consent & Consent Bypass Meta (Facebook, Instagram) switching to "Legitimate Interest" for ads after noyb win. noyb will take immediate action to stop this illegal practice…
> The growth of generative artificial intelligence systems has led EU lawmakers to focus on General Purpose AI in drafting the AI Act, which will set the framework governing…
Voorlopig vonnis, inspectierecht op grond van artikel 15 AVG, toepasselijkheid van artikel 843a van het Burgerlijk Wetboek.
Interlocutory judgment, right of inspection pursuant to art 15 AVG, applicability of art 843a Rv.
> Thirteen non-EU countries sometimes accept “social media profiles and phone contacts” as evidence of identity for the purpose of deportations, according to an internal European…
> Read through the most interesting developments at the intersection of human rights and technology from the Netherlands. This is the second update in this series.
> The CSA Regulation, proposed by European Commissioner Ylva Johansson, could undermine the trust we have in secure and confidential processes like sending work emails,…
> Personal data protection and whistleblowing are two different topics — different regulations with different purposes, scope and requirements. But, in fact, they are closer than…
Blogpost 15/2023: De verplichting voor nationale rechtbanken om een voorlopig advies aan te vragen bij het Gerechtshof van de Europese Unie (HvJ EU) is een onderwerp dat al lang…
> Blogpost 15/2023 The obligation of national courts to seek preliminary reference from the Court of Justice of the EU (CJEU) is a long-debated topic. In EU law, it is framed as…
De lidstaten van de Europese Unie hebben een gemeenschappelijk standpunt bereikt over de voorgestelde Dataregelgeving, waardoor de onderhandelingen over de definitieve versie van…
> EU member states reached a common position on the proposed Data Act, enabling negotiations on the final version of the proposed legislation to begin among the Council of the…
Credit Scoring The frequently criticized credit referencing agency CRIF GmbH has collected addresses, dates of birth and names of almost all Austrians in order to calculate…
> Norway's data protection authority, the Datatilsynet, fined U.S.-based Argon Medical Devices 2.5 million kroner for failing to report a July 2021 data breach within the 72-hour…
Arrondissementsrechtbank Noord-Holland, 15 februari 2023, IT 4241; ECLI:NL:RBNHO:2023:2471 (Pit v. OfficeGrip Holding c.s.) Deze zaak behandelt de vraag of een nieuwe leverancier…
District Court of North Holland February 15, 2023, IT 4241; ECLI:NL:RBNHO:2023:2471 (Pit v. OfficeGrip Holding c.s.) This case deals with the question of whether a new ICT…
De Noorse autoriteit voor gegevensbescherming, het Datatilsynet, heeft het Amerikaanse bedrijf Argon Medical Devices een boete van 2,5 miljoen Noorse kroon opgelegd omdat het niet…
Political Microtargeting, Manipulation & Tracking Today, noyb filed a series of complaints against several German political parties. The parties had used microtargeting on…
Contradictory decision from the Austrian Federal Administrative Court (BVwG): Cell phone traffic and location data are particularly sensitive data that require additional…
Data Transfers Austrian DSB: Meta Tracking Tools Illegal In a groundbreaking decision in one of noybs 101 complaints, the Austrian Data Protection Authority (DSB) has decided that…
Collective action against three companies of the Facebook group under Art. 3:305a BW (old). Processing personal data for advertising purposes without a basis as referred to in the…
Collectieve actie tegen drie bedrijven die onderdeel uitmaken van de Facebook-groep, gebaseerd op artikel 3:305a van het Burgerlijk Wetboek (oud). Verwerking van persoonlijke…
BfDI stellt 31. Tätigkeitsbericht vor
Arrondissementsrechtbank Zeeland-West-Brabant, 3 maart 2023, IT 4234; ECLI:NL:RBZWB:2023:1459 (Eiser tegen Minister van Defensie). Bestuursrecht. De eiser heeft een verzoek…
Zeeland-West Brabant District Court March 03, 2023, IT 4234; ECLI:NL:RBZWB:2023:1459 (Claimant v. Minister of Defense) Administrative Law. The plaintiff filed a request for access…
Interlocutoire beroep. Het verzoek om de BKR-registratie te verwijderen is afgewezen. De termijn van vijf jaar is pas net begonnen (november 2022). Er is onvoldoende bewijs om aan…
Eerlijke vergoeding na ontbinding van het dienstverband door de rechtbank. De rechtbank oordeelde dat de werkgever ernstig tekort was geschoten door de privacy van de werknemer…
Fair compensation after dissolution by subdistrict court. The court held that the employer had acted seriously culpable by seriously violating the employee's privacy, not being…
Interlocutory appeal. Removal of BKR registration rejected. Five-year term only just started (November 2022). For lack of substantiation, cannot establish that debts were actually…