Data protection and digital regulation developments, collected automatically from 17+ sources.
Get this as an email digestThe launch of a register for Data Protection Officers. "To strengthen the position of the data protection officer (DPO) and to ensure quality, [as was also announced in the…
Parliamentary Papers II, 2024-2025, 23 645, no.
Government-wide GDPR audit 2024.
Political Microtargeting, Manipulation & Tracking In March 2023, noyb filed complaints against several German political parties: During the 2021 elections, CDU, AfD, SPD, Bündnis…
Data Subject Rights The highly popular smartphone app WetterOnline shares the personal data of its users with hundreds of third-party companies for advertising purposes. Until a…
Parliamentary Papers II 2024-2025, 35968, no. 24 - Repeal of the Public Records Act 1995 and replacement by a new Public Records Act (Public Records Act 20..), Amended amendment…
Cabinet response to the report 'Ethnic profiling is a government-wide problem' by Amnesty International.
Results of the exploratory study: a right to be forgotten for every 18-year-old as a matter of course. In mid-November 2024, a motion was passed to explore how the right to data…
National Administrative Procedures and DPA inactivity Today, the EU's General Court held that the Irish DPC acted unlawful when it refused to investigate a noyb complaint. The…
National Administrative Procedures and DPA inactivity When the General Data Protection Regulation (GDPR) came into force in 2018, it ushered in a new era of data protection in the…
Data Transfers Since the Snowden disclosures we know that the US engages in mass surveillance of EU users by scooping up personal data from US Big Tech. The "Privacy and Civil…
EDSA Provides Greater Clarity on Pseudonymization
Data Transfers Today, noyb has filed GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi for unlawful data transfers to China. While four of them openly…
In the judgment C-416/23, the Austrian Data Protection Authority (DSB) received a slap in the face from the CJEU. The authority has – arbitrarily – set the number of complaints…
Berlin Group Adopts Papers on LLMs and Data Sharing
Biometric Data Today, noyb filed a GDPR complaint against Ryanair. Booking a flight on the airline’s website not only requires a mandatory account. New customers must also go…
Data Subject Rights noyb has achieved a win against Netflix. Almost five years after the complaint has been filed, the Dutch data protection authority (DPA) has finally issued a…
Data Protection Enables Responsible AI
Political Microtargeting, Manipulation & Tracking noyb win against the European Commission: The EDPS (European Data Protection Supervisor) has issued a decision finding that the…
Forced Consent & Consent Bypass Today, noyb has filed a complaint against the social media platform BeReal over the latest “dark pattern” to get consent. When people open the app,…
Data Subject Rights noyb is now approved as a so-called "Qualified Entity" to bring collective redress actions in courts throughout the European Union. Such action under Directive…
Data Subject Rights noyb welcomes yesterday's leading decision of the German Federal Court of Justice on claims in connection with a data protection incident at Facebook Copyright…
Forced Consent & Consent Bypass In the battle over the illegal use of personal data for advertisement, Meta has announced another variation that is not "Yes or No" consent: This…
Global Privacy Assembly Adopts Resolution on Trustworthy International Data Transfers
Online & Mobile tracking Today, noyb filed a complaint against the social media platform Pinterest. Most users probably know it as a visual mood board and use it to find ideas and…
BfDI at the G7 Roundtable in Rome
BfDI Welcomes EDSA Guidelines on Legitimate Interest
Online & Mobile tracking In today's ruling in C-446/21 (Schrems v. Meta), the Court of Justice of the European Union (CJEU) has fully backed a lawsuit brought against Meta over…
BfDI Welcomes BKA-II Decision
Online & Mobile tracking Today, noyb filed a complaint against Mozilla for quietly enabling a supposed “privacy feature” (called Privacy Preserving Attribution) in its Firefox…
Forced Consent & Consent Bypass Following several noyb complaints from 2023, the Belgian data protection authority has ordered four major Belgian news sites to bring their cookie…
New BfDI Takes Office
Profiling & Automated Decision Making Today, noyb lodged a complaint with the Austrian data protection authority against the credit reference agency KSV1870 and the energy…
Data Security In early May 2024, the European Parliament informed its staff of a massive data breach in the institution’s recruiting platform (called “PEOPLE”). The breach…
Data Subject Rights Greek supermarket chain Alfa Vita (AB) runs a loyalty card program, allowing the collection of personal data of shoppers. Still, the company can’t even comply…
Artificial Intelligence Recently, Twitter International (now re-branded as “X”) began unlawfully using the personal data of more than 60 million users in the EU/EEA to train its…
Data Subject Rights Contrary to EU law, the Swedish Data Protection Authority (IMY) regularly refuses to properly handle complaints from data subjects. Even after a ruling by the…
Forced Consent & Consent Bypass Following a complaint by noyb, the Hamburg data protection authority declared the use of controversial ‘Pay or OK’ systems to be permissible.…
In 2023, noyb continued to be one of the major European forces pushing for the fundamental right to data protection for all users. Our achievements this year prove once again that…
The European Parliament and the Council of the EU have now published their amendments to the Commission's draft GDPR procedural regulation. We have analysed the two versions and…
Cookie Banners Following several hundred noyb complaints against companies that use questionable consent banners, the European Data Protection Board established a "cookie banner…
Data Subject Rights Advertising broker Xandr (a Microsoft subsidiary) collects and shares the personal data of millions of Europeans for detailed targeted advertising. This allows…
Online & Mobile tracking Today, a Norwegian court has confirmed that Grindr violated the GDPR by sharing user data with advertisers. This also confirms that Grindr must pay a fine…
Artificial Intelligence In response to 11 noyb complaints, the DPC has announced (late Friday afternoon) that Meta has committed to the DPC that it will not process EU/EEA user…
Forced Consent & Consent Bypass After years of growing criticism over invasive ad tracking, Google announced in September 2023 that it would phase out third-party cookies from its…
Berlin Group Adopts Working Paper on Digital Central Bank Money
BfDI and ICO Strengthen Cooperation
Artificial Intelligence Over the past few days, Meta has informed millions of Europeans that its privacy policy is changing once again. Only on closer inspection of the links in…
BfDI Calls for an Update to Freedom of Information Laws
Forced Consent & Consent Bypass noyb has today lodged a GDPR complaint against Kurier. Just a few months ago, users were forced to consent to Google and other tracking cookies…
Berlin Group Adopts Working Paper on Facial Recognition Technology
Data Subject Rights In the wake of the pandemic, schools in the European Union have increasingly begun to implement digital services for online learning. While these modernisation…
The Federal Data Protection Commissioner Files a Lawsuit Against the Federal Intelligence Service
Artificial Intelligence In the EU, the GDPR requires that information about individuals is accurate and that they have full access to the information stored, as well as…
Online Advertising CJEU press releases (look for C-446/21 - Schrems)Full AG OpinionKatharina Raabe-Stuppnig, lawyer representing Mr Schrems: "We are very pleased by the opinion,…
Bilateral Meeting Between the BfDI and the Garante
Forced Consent & Consent Bypass Today, the EDPB has issued its first decision on "Pay or Okay" in relation to large online platforms such as Instagram and Facebook, as first…
Forced Consent & Consent Bypass So-called pay or consent systems are on the rise in Europe. First introduced by journalistic websites that were suffering from the loss of…
BfDI Presents Its 32nd Annual Report
Forced Consent & Consent Bypass The European Data Protection Board (EDPB) will soon decide about the future of free consent online. Following Meta’s introduction of a “Pay or…
National Administrative Procedures and DPA inactivity Would you like a license to break the law? Sweden may be your dream destination: Thanks to a loophole in national law, large…
BfDI Welcomes the European AI Regulation
Credit Scoring Today, noyb has filed a complaint and report against the German credit agency SCHUFA with the Hessian data protection authority. The company appears to be making…
Forced Consent & Consent Bypass The European Data Protection Board (EDPB) will soon issue what is likely to be its most significant opinion to date: It will determine whether…
BfDI Calls for Respect for Fundamental Rights in Chat Monitoring
Credit Scoring noyb has scored a stage victory in its proceedings against the credit reference agency CRIF and the address trader Acxiom in Germany. The companies are illegally…
When the GDPR came into force in 2018, the new and shiny data protection law was hailed as a shift towards stricter enforcement – ensuring that in the EU, the fundamental right to…
Forced Consent & Consent Bypass Since the beginning of November, Instagram and Facebook users who don’t want to be tracked have to pay a “privacy fee” of up to € 251.88 per year.…
Credit Scoring Today, noyb filed a complaint and report against the creditors’ association KSV1870 with the Austrian data protection authority. Although Article 15 GDPR stipulates…
BfDI Advocates for Free and Trustworthy Global Data Flows
Political Microtargeting, Manipulation & Tracking Today, noyb filed a complaint against X (Twitter) for unlawfully using the political views and religious beliefs of its users for…
Credit Scoring Note: The judgments are not connected to noyb cases CJEU landmark rulings on “credit ranking” and review of DPAs The European Court of Justice (CJEU) today issued…
Credit Scoring noyb has filed a lawsuit against the credit reference agency CRIF GmbH and the address trader AZ Direct. The companies secretly trade the address data of almost…
Forced Consent & Consent Bypass Today, noyb filed a complaint against Meta with the Austrian data protection authority. European users now have the “choice” to either consent to…
BfDI Criticizes Intelligence Agency Laws
Political Microtargeting, Manipulation & Tracking noyb files complaint against EU Commission over targeted chat control ad campaign Today, noyb filed a complaint against the EU…
IFK Calls for a Consistently High Level of Transparency at the Federal and State Levels
Credit Scoring Address trader sues German DPA to prevent noyb from accessing files Two years ago, noyb filed a complaint against the address trader Acxiom and the credit reference…
BfDI Criticizes Draft of the Financial Crime Prevention Act
Berlin Group Adopts Working Paper on Telemetry
Data Subject Rights Streaming service DAZN took almost five years to answer a simple access request In January 2019, noyb filed two complaints against the streaming service DAZN…
Forced Consent & Consent Bypass Meta (Facebook / Instagram) to move to a "Pay for your Rights" approach The Wall Street Journal reported that Meta plans to move to a "Pay for your…
Online & Mobile tracking € 5,8 million fine for Grindr – appeal by Grindr failed In 2020, the Norwegian Consumer Council (NCC) filed a complaint to the Norwegian Data Protection…
BfDI Criticizes Law on the Use of Automated Systems at the FIU
BfDI Calls for More Effective Rules to Enforce the GDPR in Cross-Border Cases
Forced Consent & Consent Bypass Today, noyb filed three complaints in France against Fnac (the largest electronics store in France), the real estate app SeLoger and the fitness…
Berlin Group Adopts Working Paper on “Smart Cities”
Forced Consent & Consent Bypass Today, noyb filed three complaints against Fitbit in Austria, the Netherlands and in Italy. The popular health and fitness company, acquired by…
Annual Report 2022 In 2022, noyb continued its longstanding fight for users’ right to privacy. Although the GDPR always foresaw a strong role for non-profits in this regard, we…
Data Transfers 23 years of illegal data transfers due to inactive DPAs and new EU-US deals In two landmark rulings in 2015 and 2020, the Court of Justice of the European Union…
Forced Consent & Consent Bypass Meta apparently switches to consent for behavioral ads after five years of litigation After more than five years of extensive litigation by noyb,…
Biometric Data Today, noyb filed a complaint against Ryanair. When booking through an online travel agent and not directly on its website or app, Europe’s biggest airline requires…
Cookie Banners Unlawful Cookie Banners: Belgian DPA let news outlets buy themselves free from GDPR compliance Belgian news outlets relying on illegal cookie banners paid € 10.000…
Forced Consent & Consent Bypass Norwegian DPA temporarily bans behavioral advertising on Facebook and Instagram Following a CJEU ruling that declared Meta/Facebook’s GDPR approach…
Cookie Banners „Pay or Okay“ on tech news site heise.de illegal, decides German DPA. Major implications for many other German news pages. One of the largest German-language tech…
Data Transfers Open letter: Repeated false allegations of a “business model” when citizens exercise their rights Instead of focusing on the legal matters of the supposedly new…
Data Transfers New Trans-Atlantic Data Privacy Framework largely a copy of "Privacy Shield". noyb will challenge the decision. Third attempt of the European Commission to get a…
The GDPR allows for six legal bases to process personal data. In the case Meta v Bundeskartellamt, the CJEU has today ruled on all of them - further clarifying the interpretation…
National Administrative Procedures and DPA inactivity GDPR Procedures Regulation: Commission Proposal is an attack on users' rights in GDPR procedures Today the EU Justice…
The BfDI Welcomes the ECJ's Meta Ruling
Data Transfers noyb win: First major fine (€ 1 million) for using Google Analytics Following noyb’s 101 complaints on unlawful EU-US data transfers, the Swedish data protection…
Ireland makes questionable GDPR cases 'confidential'. Irish DPC will likely use Section 26A to muzzle criticism. Despite profound criticism by civil society (ICCL, Amnesty, EDRi,…
National Administrative Procedures and DPA inactivity Ireland: Reporting about DPC procedures soon a crime! Irish Parliament can stop last-minute "gag order" amendment. In a…
Profiling & Automated Decision Making Today, noyb filed a complaint against TeleSign, a US company which profiled millions of phone users. TeleSign generates a “reputation score”…
Data Subject Rights The French Data Protection Authority (CNIL) fined Criteo, a major online advertisement and tracking company in Europe, €40 million for violating the GDPR. This…
IFK Calls for a Modern Federal Press Law
Data Subject Rights Following a noyb complaint and litigation over inactivity, the Swedish Data Protection Authoirty (IMY) has issued a fine of 58 Mln Swedish Crown (about € 5…
Joint Press Release – Uniform Rules for Data Protection Fines in Europe
Credit Scoring noyb's legal proceedings against the credit reporting agency CRIF are uncovering a multitude of legal violations and cynical interpretations of the GDPR, exposing a…
BfDI Draws Positive Conclusions on 5 Years of the GDPR
5 Years of the GDPR—The General Data Protection Regulation as a Benchmark in the Digital Landscape
. 85% of noyb cases not decided.On 25 May 2018, the GDPR came into force. While the contents of EU data protection rules stayed largely the same, the alleged big change was the…
The publication of its activity report enables the CNIL to report on its actions with regard to its four major missions: inform and protect the general public, accompany and…
Data Transfers Today, a decade-long (2013 - 2023) case on Meta's involvement in US mass surveillance has lead to a first direct decision. Meta must stop any further transfers of…
Political Microtargeting, Manipulation & Tracking Data Breach in Malta: Company must disclose source within 20 days or face penalties The Maltese Data Protection Authority (IDPC)…
Background information Following a complaint by the PRIVACY INTERNATIONAL association, the CNIL carried out four investigations into DOCTISSIMO. The doctissimo.fr website mainly…
Purchase. Claim for damages against the client. The right to invoke the doctrine of estoppel is recognized. The plaintiff did not challenge the tender decision within 20 days in a…