News

Short: ⇄

For some time, various bottlenecks have been observed in (proactive) government service delivery. In this context, some have been addressed, but many remain outstanding.…

AI hallucinations: ChatGPT created a fake child murderer

Artificial Intelligence OpenAI’s highly popular chatbot, ChatGPT, regularly gives false information about people without offering any way to correct it. In many cases, these…

Concise government.

Status update from the Tax Authority: In preparation for a parliamentary debate on the Tax Authority (March 13, 2025), a comprehensive set of information has been made public,…

(A) The (special) personal data are already in the possession of the tax authorities.

Advice on Data Foundations & Analytics (October 2024) from the Analytics Advisory Committee, which specifically addresses: "The question is whether collecting additional…

Documents related to the decision regarding the disclosure of personal data by the Ministry of Defence to trade unions during reorganizations.

Documents related to the decision regarding the disclosure of personal data by the Ministry of Defence to trade unions during reorganizations.

In short:

One of the use cases aims to: "Scale up the use of drone operations for surveillance and incident response, with the goal of increasing the speed, safety, and efficiency of…

"This is the second part of a report on the implementation and use of the Risk Analysis Model (RAM) within the Dutch Tax Authority, the Benefits Agency, and Customs. The report examines, among other things, any potential negative consequences for citizens and businesses..."

Report on the Risk Analysis Model (RAM) at the Dutch Tax Administration, Benefits Administration, and Customs (Part 2) "This is the second part of the report concerning the…

"I endorse the importance of a secure infrastructure for the deployment of AI within governments. Therefore, I support investigating possibilities to shape government policy such that AI models run locally in principle, except... ⇄

Parliamentary letter regarding the appreciation of the motion by member Six Dijkstra on investigating the local operation of AI models within the government "I endorse the…

9 ⇄

Amendment Act on the restriction of access to UBO registers, Parliamentary Papers II 2024-25, no. 36584 nos.

In brief: ⇄

On 16 April 2024, the House adopted motions requesting the government to provide more aid and support to adoptees and to ensure that adoption files are properly accessible. The…

Short: ⇄

One of the use cases has the objective: "Scaling up the deployment of drone operations for surveillance and incidents, with the aim of increasing the speed, safety, and efficiency…

Short: ⇄

The implementation of the legislative amendment varied significantly between organizations, with complexity primarily depending on existing reporting facilities and the need for…

NCTV memorandum on the status of (information) security following ADR investigation ⇄

NCTV memorandum on the status of (information) security following ADR investigation "The NCTV processes personal data within the currently applicable frameworks of the GDPR. This,…

Woo decision regarding the handling of GDPR requests at DUO ⇄

Woo decision GDPR manuals and templates ⇄

Decision on Woo request regarding Woo requests and GDPR processing ⇄

Documents accompanying the Open Government Act (Woo) decision regarding the sharing of personal data by the Ministry of Defence with trade unions during reorganisations ⇄

"This report inventories the extent to which there is insight into whether systems of the Tax and Customs Administration that are comparable to the Risk Analysis Model (RAM) comply with the Integral Security Reference Architecture and whether co... ⇄

Review of systems comparable to RAM "This report inventories the extent to which there is insight into whether systems of the Tax and Customs Administration that are comparable to…

"This report examines the design and use of the Risk Analysis Model (RAM) within the Tax and Customs Administration, the Benefits Service and Customs. In doing so, the report looks, among other things, at any adverse consequences for citizens and businesses caused by unr... ⇄

Outcomes of External investigation into the Risk Analysis Model (RAM) at the Tax and Customs Administration, the Benefits Service and Customs. Report on the investigation of the…

The administrative response thereto ⇄

(A) The (special categories of) personal data are already in the possession of the Tax and Customs Administration. ⇄

Data Foundations & Analytics Advice (Oct. 2024) from the Analytics Advisory Committee, which explicitly addressed: "The question is whether collecting additional (special…

Three AP advisories bundled ⇄

Government letter ⇄

State of affairs regarding the Tax and Customs Administration. In preparation for a committee debate concerning the Tax and Customs Administration (13 March 2025), a series of…

Swedbank refuses transparency in automatic interest calculation

Data Subject Rights Nowadays, more and more banks set their interest rates automatically, and without any human intervention. But even the smallest inaccuracies can cost consumers…

Act on Reducing School Absenteeism ⇄

Parliamentary Papers II 2024-2025, 36663, no. 7. Letter from the temporary Committee on Fundamental Rights and Constitutional Review regarding an advisory report on the…

Repeal of the Public Records Act 1995 and replacement by a new Public Records Act (Public Records Act 20..) ⇄

Parliamentary Papers II 2024-2025, 35968, no. 30, (Repeal of the Public Records Act 1995 and replacement by a new Public Records Act (Public Records Act 20..)), Further amended…

Amendment Act on limiting access to UBO registers ⇄

Parliamentary Papers II 2024-2025, 36584, 18 (Amendment Act on limiting access to UBO registers), Motion by Member Flach et al.

Amendment Act on the Restriction of Access to the UBO Register ⇄

Rules regarding data processing by partnerships ⇄

The Minister: "Although the AP has not yet issued a final ruling, it is clear that there are concerns regarding the privacy implications of using Google Analytics. Should the AP decide that the use of Google Analytics in its current form... ⇄

Response to parliamentary questions regarding the sharing of personal data through the use of Google Analytics on werkenvoornederland.nl and specific application procedures. The…

Letter from CTIVD regarding public-private partnership and the response thereto from the Ministers of the Interior and Kingdom Relations and Defence ⇄

Parliamentary Papers II, 2024-2025, 23 645, no. 834 ⇄

Parliamentary Papers II, 2024-2025, 23 645, no.

Partial Report BZK ⇄

Government-wide GDPR audit 2024.

Snap Election faster than German DPAs: Microtargeting continues to influence voters

Political Microtargeting, Manipulation & Tracking In March 2023, noyb filed complaints against several German political parties: During the 2021 elections, CDU, AfD, SPD, Bündnis…

Amendment Act restricting access to the UBO register ⇄

Amended amendment ⇄

Parliamentary Papers II 2024-2025, 35968, no. 24 - Repeal of the Public Records Act 1995 and replacement by a new Public Records Act (Public Records Act 20..), Amended amendment…

Ethnic profiling is a government-wide problem ⇄

Cabinet response to the report 'Ethnic profiling is a government-wide problem' by Amnesty International.

a motion was adopted ⇄

Results of the exploratory study: a right to be forgotten for every 18-year-old as a matter of course. In mid-November 2024, a motion was passed to explore how the right to data…

EU Court: Irish DPC must investigate noyb complaint

National Administrative Procedures and DPA inactivity Today, the EU's General Court held that the Irish DPC acted unlawful when it refused to investigate a noyb complaint. The…

Data Protection Day: Only 1.3% of cases before EU DPAs result in a fine

National Administrative Procedures and DPA inactivity When the General Data Protection Regulation (GDPR) came into force in 2018, it ushered in a new era of data protection in the…

US Cloud soon illegal? Trump punches first hole in EU-US Data Deal

Data Transfers Since the Snowden disclosures we know that the US engages in mass surveillance of EU users by scooping up personal data from US Big Tech. The "Privacy and Civil…

EDSA Provides Greater Clarity on Pseudonymization ⇄

EDSA Provides Greater Clarity on Pseudonymization

TikTok, AliExpress, SHEIN & Co surrender Europeans’ data to authoritarian China

Data Transfers Today, noyb has filed GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi for unlawful data transfers to China. While four of them openly…

Austrian data protection authority slammed by CJEU

In the judgment C-416/23, the Austrian Data Protection Authority (DSB) received a slap in the face from the CJEU. The authority has – arbitrarily – set the number of complaints…

Test News Article

Berlin Group Adopts Papers on LLMs and Data Sharing ⇄

Berlin Group Adopts Papers on LLMs and Data Sharing

Want to book a Ryanair flight? Prepare for a face scan!

Biometric Data Today, noyb filed a GDPR complaint against Ryanair. Booking a flight on the airline’s website not only requires a mandatory account. New customers must also go…

noyb WIN: Dutch authority fines Netflix €4.75 Million

Data Subject Rights noyb has achieved a win against Netflix. Almost five years after the complaint has been filed, the Dutch data protection authority (DPA) has finally issued a…

Data Protection Enables Responsible AI ⇄

Data Protection Enables Responsible AI

Political Microtargeting by EU Commission illegal

Political Microtargeting, Manipulation & Tracking noyb win against the European Commission: The EDPS (European Data Protection Supervisor) has issued a decision finding that the…

BeReal: The app that won’t take no for an answer

Forced Consent & Consent Bypass Today, noyb has filed a complaint against the social media platform BeReal over the latest “dark pattern” to get consent. When people open the app,…

noyb is now qualified to bring collective redress actions

Data Subject Rights noyb is now approved as a so-called "Qualified Entity" to bring collective redress actions in courts throughout the European Union. Such action under Directive…

German BGH: GDPR compensation for loss of control

Data Subject Rights noyb welcomes yesterday's leading decision of the German Federal Court of Justice on claims in connection with a data protection incident at Facebook Copyright…

Ads: Meta wants to be 'less illegal' - but much more annoying...

Forced Consent & Consent Bypass In the battle over the illegal use of personal data for advertisement, Meta has announced another variation that is not "Yes or No" consent: This…

Global Privacy Assembly Adopts Resolution on Trustworthy International Data Transfers ⇄

Global Privacy Assembly Adopts Resolution on Trustworthy International Data Transfers

Pinterest pins users’ data down - without consent!

Online & Mobile tracking Today, noyb filed a complaint against the social media platform Pinterest. Most users probably know it as a visual mood board and use it to find ideas and…

BfDI at G7 Roundtable in Rome ⇄

BfDI at the G7 Roundtable in Rome

BfDI Welcomes EDSA Guidelines on Legitimate Interest ⇄

BfDI Welcomes EDSA Guidelines on Legitimate Interest

CJEU: Meta must "minimise" use of personal data for ads

Online & Mobile tracking In today's ruling in C-446/21 (Schrems v. Meta), the Court of Justice of the European Union (CJEU) has fully backed a lawsuit brought against Meta over…

BfDI Welcomes BKA-II Decision ⇄

BfDI Welcomes BKA-II Decision

Firefox tracks you with “privacy preserving” feature

Online & Mobile tracking Today, noyb filed a complaint against Mozilla for quietly enabling a supposed “privacy feature” (called Privacy Preserving Attribution) in its Firefox…

noyb WIN: Belgian DPA “settlement” turned into proper legal orders on deceptive cookie banners

Forced Consent & Consent Bypass Following several noyb complaints from 2023, the Belgian data protection authority has ordered four major Belgian news sites to bring their cookie…

New BfDI Takes Office ⇄

New BfDI Takes Office

Unsere Wasserkraft & KSV 1870: Clean electricity only after a dirty credit check?

Profiling & Automated Decision Making Today, noyb lodged a complaint with the Austrian data protection authority against the credit reference agency KSV1870 and the energy…

noyb files two complaints against EU Parliament over massive data breach

Data Security In early May 2024, the European Parliament informed its staff of a massive data breach in the institution’s recruiting platform (called “PEOPLE”). The breach…

8 Years of GDPR: Greek supermarket’s Loyalty Card still not compliant

Data Subject Rights Greek supermarket chain Alfa Vita (AB) runs a loyalty card program, allowing the collection of personal data of shoppers. Still, the company can’t even comply…

Twitter’s AI plans hit with 9 more GDPR complaints

Artificial Intelligence Recently, Twitter International (now re-branded as “X”) began unlawfully using the personal data of more than 60 million users in the EU/EEA to train its…

noyb takes Swedish DPA to court for refusing to properly deal with complaints

Data Subject Rights Contrary to EU law, the Swedish Data Protection Authority (IMY) regularly refuses to properly handle complaints from data subjects. Even after a ruling by the…

‘Pay or OK’ at DER SPIEGEL: noyb sues Hamburg DPA

Forced Consent & Consent Bypass Following a complaint by noyb, the Hamburg data protection authority declared the use of controversial ‘Pay or OK’ systems to be permissible.…

Annual Report 2023 out now!

In 2023, noyb continued to be one of the major European forces pushing for the fundamental right to data protection for all users. Our achievements this year prove once again that…

Analysis: GDPR Procedural Regulation enters critical phase

The European Parliament and the Council of the EU have now published their amendments to the Commission's draft GDPR procedural regulation. We have analysed the two versions and…

noyb's Consent Banner Report: How authorities actually decide

Cookie Banners Following several hundred noyb complaints against companies that use questionable consent banners, the European Data Protection Board established a "cookie banner…

Microsoft's Xandr grants GDPR rights at a rate of 0%

Data Subject Rights Advertising broker Xandr (a Microsoft subsidiary) collects and shares the personal data of millions of Europeans for detailed targeted advertising. This allows…

Norwegian court confirms € 5.7 million fine for Grindr

Online & Mobile tracking Today, a Norwegian court has confirmed that Grindr violated the GDPR by sharing user data with advertisers. This also confirms that Grindr must pay a fine…

(Preliminary) noyb WIN: Meta stops AI plans in the EU

Artificial Intelligence In response to 11 noyb complaints, the DPC has announced (late Friday afternoon) that Meta has committed to the DPC that it will not process EU/EEA user…

Google Chrome: Agree to 'privacy feature', but get tracking!

Forced Consent & Consent Bypass After years of growing criticism over invasive ad tracking, Google announced in September 2023 that it would phase out third-party cookies from its…

Berlin Group Adopts Working Paper on Digital Central Bank Money ⇄

Berlin Group Adopts Working Paper on Digital Central Bank Money

BfDI and ICO Strengthen Cooperation ⇄

BfDI and ICO Strengthen Cooperation

noyb urges 11 DPAs to immediately stop Meta's abuse of personal data for AI

Artificial Intelligence Over the past few days, Meta has informed millions of Europeans that its privacy policy is changing once again. Only on closer inspection of the links in…

BfDI Calls for an Update on Freedom of Information ⇄

BfDI Calls for an Update to Freedom of Information Laws

Two are better than one?! Kurier forced users to give their consent

Forced Consent & Consent Bypass noyb has today lodged a GDPR complaint against Kurier. Just a few months ago, users were forced to consent to Google and other tracking cookies…

Berlin Group Adopts Working Paper on Facial Recognition Technology ⇄

Berlin Group Adopts Working Paper on Facial Recognition Technology

Microsoft violates children’s privacy – but blames your local school

Data Subject Rights In the wake of the pandemic, schools in the European Union have increasingly begun to implement digital services for online learning. While these modernisation…

The Federal Data Protection Commissioner Files a Lawsuit Against the Federal Intelligence Service ⇄

The Federal Data Protection Commissioner Files a Lawsuit Against the Federal Intelligence Service

ChatGPT provides false information about people, and OpenAI can’t correct it

Artificial Intelligence In the EU, the GDPR requires that information about individuals is accurate and that they have full access to the information stored, as well as…

AG at CJEU: Facebook must "minimize" personal data for ads in EU

Online Advertising CJEU press releases (look for C-446/21 - Schrems)Full AG OpinionKatharina Raabe-Stuppnig, lawyer representing Mr Schrems: "We are very pleased by the opinion,…

Bilateral Meeting Between the BfDI and the Garante ⇄

Bilateral Meeting Between the BfDI and the Garante

EDPB Opinion: Meta cannot rely on "Pay or Okay"

Forced Consent & Consent Bypass Today, the EDPB has issued its first decision on "Pay or Okay" in relation to large online platforms such as Instagram and Facebook, as first…

'Pay or Okay' explained: Why more and more websites make you pay for your privacy

Forced Consent & Consent Bypass So-called pay or consent systems are on the rise in Europe. First introduced by journalistic websites that were suffering from the loss of…

BfDI Presents Its 32nd Annual Report ⇄

BfDI Presents Its 32nd Annual Report

"Pay or Okay": 1,500 € a year for your online privacy?

Forced Consent & Consent Bypass The European Data Protection Board (EDPB) will soon decide about the future of free consent online. Following Meta’s introduction of a “Pay or…

Swedish data brokers claim journalists’ legal protection to evade EU law

National Administrative Procedures and DPA inactivity Would you like a license to break the law? Sweden may be your dream destination: Thanks to a loophole in national law, large…

BfDI Welcomes the European AI Regulation ⇄

BfDI Welcomes the European AI Regulation

German credit agency earns millions through unlawful customer manipulation

Credit Scoring Today, noyb has filed a complaint and report against the German credit agency SCHUFA with the Hessian data protection authority. The company appears to be making…

28 NGOs urge EU DPAs to reject “Pay or Okay” on Meta

Forced Consent & Consent Bypass The European Data Protection Board (EDPB) will soon issue what is likely to be its most significant opinion to date: It will determine whether…

BfDI Calls for Fundamental Rights to Be Respected in Chat Monitoring ⇄

BfDI Calls for Respect for Fundamental Rights in Chat Monitoring

German DPA declares data trading between credit agency and address trader illegal

Credit Scoring noyb has scored a stage victory in its proceedings against the credit reference agency CRIF and the address trader Acxiom in Germany. The companies are illegally…

Data Protection Day: 74% of insiders see ‘relevant violations’ at most companies

When the GDPR came into force in 2018, the new and shiny data protection law was hailed as a shift towards stricter enforcement – ensuring that in the EU, the fundamental right to…

Meta ignores the users’ right to easily withdraw consent

Forced Consent & Consent Bypass Since the beginning of November, Instagram and Facebook users who don’t want to be tracked have to pay a “privacy fee” of up to € 251.88 per year.…

Creditors' association earns millions with (actually) cost-free GDPR rights

Credit Scoring Today, noyb filed a complaint and report against the creditors’ association KSV1870 with the Austrian data protection authority. Although Article 15 GDPR stipulates…

BfDI Advocates for Free and Trustworthy Global Data Flows ⇄

BfDI Advocates for Free and Trustworthy Global Data Flows

GDPR complaint against X (Twitter) over illegal micro-targeting for chat control ads

Political Microtargeting, Manipulation & Tracking Today, noyb filed a complaint against X (Twitter) for unlawfully using the political views and religious beliefs of its users for…

CJEU landmark rulings on “credit ranking” and review of DPAs

Credit Scoring Note: The judgments are not connected to noyb cases CJEU landmark rulings on “credit ranking” and review of DPAs The European Court of Justice (CJEU) today issued…

noyb sues CRIF and AZ Direct for illegal and secret data processing

Credit Scoring noyb has filed a lawsuit against the credit reference agency CRIF GmbH and the address trader AZ Direct. The companies secretly trade the address data of almost…

noyb files GDPR complaint against Meta over “Pay or Okay”

Forced Consent & Consent Bypass Today, noyb filed a complaint against Meta with the Austrian data protection authority. European users now have the “choice” to either consent to…

BfDI Criticizes Intelligence Service Laws ⇄

BfDI Criticizes Intelligence Agency Laws

noyb files complaint against EU Commission over targeted chat control ads

Political Microtargeting, Manipulation & Tracking noyb files complaint against EU Commission over targeted chat control ad campaign Today, noyb filed a complaint against the EU…

IFK Calls for a Consistently High Level of Transparency at the Federal and State Levels ⇄

IFK Calls for a Consistently High Level of Transparency at the Federal and State Levels

Address trader sues German DPA to prevent noyb from accessing files

Credit Scoring Address trader sues German DPA to prevent noyb from accessing files Two years ago, noyb filed a complaint against the address trader Acxiom and the credit reference…

BfDI Criticizes Draft of the Financial Crime Prevention Act ⇄

BfDI Criticizes Draft of the Financial Crime Prevention Act

Berlin Group Adopts Working Paper on Telemetry ⇄

Berlin Group Adopts Working Paper on Telemetry

Streaming service DAZN took almost five years to answer a simple access request

Data Subject Rights Streaming service DAZN took almost five years to answer a simple access request In January 2019, noyb filed two complaints against the streaming service DAZN…

Meta (Facebook / Instagram) to move to a "Pay for your Rights" approach

Forced Consent & Consent Bypass Meta (Facebook / Instagram) to move to a "Pay for your Rights" approach The Wall Street Journal reported that Meta plans to move to a "Pay for your…

€ 5,8 million fine for Grindr confirmed

Online & Mobile tracking € 5,8 million fine for Grindr – appeal by Grindr failed In 2020, the Norwegian Consumer Council (NCC) filed a complaint to the Norwegian Data Protection…

BfDI Criticizes Law on the Use of Automated Systems at the FIU ⇄

BfDI Criticizes Law on the Use of Automated Systems at the FIU

BfDI Calls for More Effective Rules to Enforce the GDPR in Cross-Border Cases ⇄

BfDI Calls for More Effective Rules to Enforce the GDPR in Cross-Border Cases

How mobile apps illegally share your personal data

Forced Consent & Consent Bypass Today, noyb filed three complaints in France against Fnac (the largest electronics store in France), the real estate app SeLoger and the fitness…