Data protection and digital regulation developments, collected automatically from 17+ sources.
Get this as an email digestData Transfers 23 years of illegal data transfers due to inactive DPAs and new EU-US deals In two landmark rulings in 2015 and 2020, the Court of Justice of the European Union…
Forced Consent & Consent Bypass Meta apparently switches to consent for behavioral ads after five years of litigation After more than five years of extensive litigation by noyb,…
Biometric Data Today, noyb filed a complaint against Ryanair. When booking through an online travel agent and not directly on its website or app, Europe’s biggest airline requires…
Cookie Banners Unlawful Cookie Banners: Belgian DPA let news outlets buy themselves free from GDPR compliance Belgian news outlets relying on illegal cookie banners paid € 10.000…
Forced Consent & Consent Bypass Norwegian DPA temporarily bans behavioral advertising on Facebook and Instagram Following a CJEU ruling that declared Meta/Facebook’s GDPR approach…
Cookie Banners „Pay or Okay“ on tech news site heise.de illegal, decides German DPA. Major implications for many other German news pages. One of the largest German-language tech…
Data Transfers Open letter: Repeated false allegations of a “business model” when citizens exercise their rights Instead of focusing on the legal matters of the supposedly new…
Data Transfers New Trans-Atlantic Data Privacy Framework largely a copy of "Privacy Shield". noyb will challenge the decision. Third attempt of the European Commission to get a…
The GDPR allows for six legal bases to process personal data. In the case Meta v Bundeskartellamt, the CJEU has today ruled on all of them - further clarifying the interpretation…
National Administrative Procedures and DPA inactivity GDPR Procedures Regulation: Commission Proposal is an attack on users' rights in GDPR procedures Today the EU Justice…
BfDI begrüßt die Meta-Entscheidung des EuGH
Data Transfers noyb win: First major fine (€ 1 million) for using Google Analytics Following noyb’s 101 complaints on unlawful EU-US data transfers, the Swedish data protection…
Ireland makes questionable GDPR cases 'confidential'. Irish DPC will likely use Section 26A to muzzle criticism. Despite profound criticism by civil society (ICCL, Amnesty, EDRi,…
National Administrative Procedures and DPA inactivity Ireland: Reporting about DPC procedures soon a crime! Irish Parliament can stop last-minute "gag order" amendment. In a…
Profiling & Automated Decision Making Today, noyb filed a complaint against TeleSign, a US company which profiled millions of phone users. TeleSign generates a “reputation score”…
Data Subject Rights The French Data Protection Authority (CNIL) fined Criteo, a major online advertisement and tracking company in Europe, €40 million for violating the GDPR. This…
IFK fordert zeitgemäßes Bundespressegesetz
Data Subject Rights Following a noyb complaint and litigation over inactivity, the Swedish Data Protection Authoirty (IMY) has issued a fine of 58 Mln Swedish Crown (about € 5…
Gemeinsame Pressemitteilung – Einheitliche Regeln für Datenschutzbußgelder in Europa
Credit Scoring noyb's legal proceedings against the credit reporting agency CRIF are uncovering a multitude of legal violations and cynical interpretations of the GDPR, exposing a…
BfDI zieht positives Fazit zu 5 Jahren DSGVO
5 Jahre DSGVO - Datenschutz-Grundverordnung als Maßstab in der digitalen Landschaft
. 85% of noyb cases not decided.On 25 May 2018, the GDPR came into force. While the contents of EU data protection rules stayed largely the same, the alleged big change was the…
The publication of its activity report enables the CNIL to report on its actions with regard to its four major missions: inform and protect the general public, accompany and…
Data Transfers Today, a decade-long (2013 - 2023) case on Meta's involvement in US mass surveillance has lead to a first direct decision. Meta must stop any further transfers of…
Political Microtargeting, Manipulation & Tracking Data Breach in Malta: Company must disclose source within 20 days or face penalties The Maltese Data Protection Authority (IDPC)…
Background information Following a complaint by the PRIVACY INTERNATIONAL association, the CNIL carried out four investigations into DOCTISSIMO. The doctissimo.fr website mainly…
The main thing is: The CNIL has been undertaking work for several years to anticipate and respond to the issues raised by AI. In 2023, it will extend its action on augmented…
Aankoop. Schadeclaim tegen de opdrachtgever. De beroepsmogelijkheid op het beginsel van estoppel wordt erkend. De eiser heeft de beslissing van de aanbesteding niet binnen 20…
> Procurement. Claim for damages against contracting authority. Reliance on estoppel succeeds. Plaintiff did not challenge the award decision in interlocutory proceedings within…
Verzoek om vrijgave van broncode. Gebruikskosten. Onrechtmatige verwijdering van broncode?
> Claim for release of source code. Use fee. Unlawful removal of source code? (Machine translated)
De schadelijke gevolgen van zogenaamde kunstmatige intelligentie zijn reëel en actueel, en zijn het gevolg van de handelingen van mensen en bedrijven die geautomatiseerde systemen…
> The harms from so-called AI are real and present and follow from the acts of people and corporations deploying automated systems. Regulatory efforts should focus on…
Ontbinding van het dienstverband als gevolg van een verstoorde arbeidsrelatie, ernstige schuld van de werkgever vanwege onvoldoende begeleiding bij de eerste poging tot…
> Dissolution because of a disturbed employment relationship, serious culpability of the employer because of insufficient reintegration in the first track and justified complaints…
On December 1, 2020, a cyberattack occurred at the municipality, during which the municipality's network and backup systems were encrypted and rendered inaccessible, and many…
> On December 1, 2020, a cyber attack took place at the municipality, encrypting and making inaccessible the municipality's network and backup systems and deleting many virtual…
The Austrian data protection authority has decided: Clearview AI, the company that sells facial recognition software to law enforcement agencies in the U.S. is no longer allowed…
Background information CLEARVIEW AI collects photos from a wide range of websites, including social networks, and sells access to its database of images of individuals via a…
Background information CLEARVIEW AI collects photographs from a wide range of websites, including social networks, and sells access to its database of images of people through a…
, contrary to national courts. Today, the Court of Justice of the European Union (CJEU) issued the first judgment on emotional damages under the GDPR, confirming that the GDPR…
noyb wins at the CJEU: Right to information must include context - in some cases also documents and database excerpts Yesterday, the Court of Justice of the European Union (CJEU)…
Camera-observatie van schadelijke uitstoot bij de verwerkingsinstallatie van Tata Steel is niet illegaal. Er wordt gesproken over effectieve observatie die niet gericht is op…
Camera surveillance of harmful emissions at Tata Steel's cooking plant is not unlawful. Spoken of effective surveillance that is not directed at individuals. Very low likelihood…
Cassatie in het belang van de rechtsorde. Openbaarheid van civiele procedures. Zijn rechtbanken verplicht om aan derden informatie te verstrekken over civiele procedures die lopen…
Cassation in the interest of the law. Disclosure of civil proceedings. Are courts required to disclose to others than parties information about civil proceedings that are or have…
Na de invoering van de EU-richtlijn inzake klokkenluiders in 2021, kregen de functionarissen voor gegevensbescherming van bedrijven de taak om veilige meldingskanalen op te…
> Following the implementation of the EU Whistleblower Directive in 2021, companies' data protection officers were tasked with setting up secure reporting channels. As these data…
Vonnis opgesteld door: Diederik Stols, Hanna van Til en Otto Volgenant, Boekx Advocaten. Rechterlijke Macht Amsterdam, 12 april 2023, IEF 21357; ECLI:NL:RBAMS:2023:2192 (EOKM v.…
Judgment submitted by: Diederik Stols, Hanna van Til, and Otto Volgenant, Boekx AdvocatenRb. Amsterdam April 12, 2023, IEF 21357; ECLI:NL:RBAMS:2023:2192 (EOKM v. Hammy Media) The…
Pornographic websites must demonstrate that persons who are identifiable in images that have not been professionally produced have given their consent for the disclosure of their…
Porn website must be able to prove that individuals who are recognizable in images in non-professionally created footage have given their consent to disclosure.
Cookie Banners "Pay or Okay" - the beginning of the end? "PUR Abo" on derStandard.at illegal according to Austrian DPA After the GDPR came into force, the Austrian daily newspaper…
Request by drivers to Ola Netherlands BV for access as referred to in Article 15 (1) AVG to certain personal data concerning them (including "ratings" given by passengers) and for…
ECJ EU, 30 maart 2023, IT 4246; ECLI:EU:C:2023:270 (Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v. Minister des Hessischen Kultusministeriums).…
ECJ EU March 30, 2023, IT 4246; ECLI:EU:C:2023:270 (Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v. Minister des Hessischen Kultusministeriums)…
Verzoek van Uber-chauffeurs aan Uber voor toegang tot bepaalde persoonsgegevens die betrekking hebben op hen (waaronder "beoordelingen" gegeven door passagiers), zoals bedoeld in…
Request from Uber drivers to Uber for access as referred to in Article 15 (1) AVG to certain personal data concerning them (including "ratings" given by passengers) and for…
Request from Uber drivers to Uber for information pursuant to Article 15(1)(h) GDPR (information on the existence of automated decision-making within the meaning of Article 22…
Request from Uber drivers to Uber for information under Article 15(1)(h) AVG (information about the existence of automated decision-making within the meaning of Article 22 AVG)…
The Netherlands Court of Audit has sent a letter to the House of Representatives highlighting bottlenecks in the implementation of the General Data Protection Regulation (GDPR) in…
The Court of Audit has sent a letter to the House of Representatives pointing out obstacles in the implementation of the General Data Protection Regulation (AVG) in the…
De eiser streeft er onder meer naar om een vermelding in het register van fraudegevallen van de SFH (een organisatie) te laten verwijderen, een vermelding die door de gedaagde…
Among other things, plaintiff seeks reversal of a listing on the SFH's fraud register by defendant (a mortgage lender) for fictitious employment. The court held that the defendant…
> No nonsense, just an opt-out: a free tool from noyb allowing you to object to Facebook quickly and easily! Use the noyb tool to opt out of targeted advertising and various other…
> No bullsh*t opt-out: free noyb tool for quick and broad Facebook objections! Use the noyb tool to opt out of targeted advertising and various other claimed 'legitimate…
Forced Consent & Consent Bypass No bullsh*t opt-out: Free noyb tool for quick and broad Facebook objections is now online! As reported last week, Meta switched the legal basis for…
Forced Consent & Consent Bypass Meta (Facebook, Instagram) switching to "Legitimate Interest" for ads after noyb win. noyb will take immediate action to stop this illegal practice…
> The growth of generative artificial intelligence systems has led EU lawmakers to focus on General Purpose AI in drafting the AI Act, which will set the framework governing…
Voorlopig vonnis, inspectierecht op grond van artikel 15 AVG, toepasselijkheid van artikel 843a van het Burgerlijk Wetboek.
Interlocutory judgment, right of inspection pursuant to art 15 AVG, applicability of art 843a Rv.
> Thirteen non-EU countries sometimes accept “social media profiles and phone contacts” as evidence of identity for the purpose of deportations, according to an internal European…
> Read through the most interesting developments at the intersection of human rights and technology from the Netherlands. This is the second update in this series.
> The CSA Regulation, proposed by European Commissioner Ylva Johansson, could undermine the trust we have in secure and confidential processes like sending work emails,…
> Personal data protection and whistleblowing are two different topics — different regulations with different purposes, scope and requirements. But, in fact, they are closer than…
Blogpost 15/2023: De verplichting voor nationale rechtbanken om een voorlopig advies aan te vragen bij het Gerechtshof van de Europese Unie (HvJ EU) is een onderwerp dat al lang…
> Blogpost 15/2023 The obligation of national courts to seek preliminary reference from the Court of Justice of the EU (CJEU) is a long-debated topic. In EU law, it is framed as…
De lidstaten van de Europese Unie hebben een gemeenschappelijk standpunt bereikt over de voorgestelde Dataregelgeving, waardoor de onderhandelingen over de definitieve versie van…
> EU member states reached a common position on the proposed Data Act, enabling negotiations on the final version of the proposed legislation to begin among the Council of the…
Credit Scoring The frequently criticized credit referencing agency CRIF GmbH has collected addresses, dates of birth and names of almost all Austrians in order to calculate…
> Norway's data protection authority, the Datatilsynet, fined U.S.-based Argon Medical Devices 2.5 million kroner for failing to report a July 2021 data breach within the 72-hour…
Arrondissementsrechtbank Noord-Holland, 15 februari 2023, IT 4241; ECLI:NL:RBNHO:2023:2471 (Pit v. OfficeGrip Holding c.s.) Deze zaak behandelt de vraag of een nieuwe leverancier…
District Court of North Holland February 15, 2023, IT 4241; ECLI:NL:RBNHO:2023:2471 (Pit v. OfficeGrip Holding c.s.) This case deals with the question of whether a new ICT…
De Noorse autoriteit voor gegevensbescherming, het Datatilsynet, heeft het Amerikaanse bedrijf Argon Medical Devices een boete van 2,5 miljoen Noorse kroon opgelegd omdat het niet…
Political Microtargeting, Manipulation & Tracking Today, noyb filed a series of complaints against several German political parties. The parties had used microtargeting on…
Contradictory decision from the Austrian Federal Administrative Court (BVwG): Cell phone traffic and location data are particularly sensitive data that require additional…
Data Transfers Austrian DSB: Meta Tracking Tools Illegal In a groundbreaking decision in one of noybs 101 complaints, the Austrian Data Protection Authority (DSB) has decided that…
Collective action against three companies of the Facebook group under Art. 3:305a BW (old). Processing personal data for advertising purposes without a basis as referred to in the…
Collectieve actie tegen drie bedrijven die onderdeel uitmaken van de Facebook-groep, gebaseerd op artikel 3:305a van het Burgerlijk Wetboek (oud). Verwerking van persoonlijke…
BfDI stellt 31. Tätigkeitsbericht vor
Arrondissementsrechtbank Zeeland-West-Brabant, 3 maart 2023, IT 4234; ECLI:NL:RBZWB:2023:1459 (Eiser tegen Minister van Defensie). Bestuursrecht. De eiser heeft een verzoek…
Zeeland-West Brabant District Court March 03, 2023, IT 4234; ECLI:NL:RBZWB:2023:1459 (Claimant v. Minister of Defense) Administrative Law. The plaintiff filed a request for access…
Interlocutoire beroep. Het verzoek om de BKR-registratie te verwijderen is afgewezen. De termijn van vijf jaar is pas net begonnen (november 2022). Er is onvoldoende bewijs om aan…
Eerlijke vergoeding na ontbinding van het dienstverband door de rechtbank. De rechtbank oordeelde dat de werkgever ernstig tekort was geschoten door de privacy van de werknemer…
Fair compensation after dissolution by subdistrict court. The court held that the employer had acted seriously culpable by seriously violating the employee's privacy, not being…
Interlocutory appeal. Removal of BKR registration rejected. Five-year term only just started (November 2022). For lack of substantiation, cannot establish that debts were actually…
Hof van Appel, 3 februari 2023, IT 4226; ECLI:NL:GHDHA:2023:306 (Veilig Thuis tegen de verzoeker). In deze zaak heeft een man verzocht om het verwijderen van zijn persoonlijke…
Hague Court of Appeal February 3, 2023, IT 4226; ECLI:NL:GHDHA:2023:306 (Veilig Thuis v. the respondent) In this case, a man requested the deletion of his personal data processed…
Request for destruction of Safe Home files; admissibility; right to erasure of personal data under the AVG and Wmo
Verzoek tot vernietiging van bestanden van Safe Home; toelaatbaarheid; recht op verwijdering van persoonsgegevens onder de AVG en de Wmo.
Today, noyb filed a series of complaints against websites and data brokers that did not correctly address access requests using cookies as an authentication factor. The companies…
De Spaanse autoriteit voor gegevensbescherming, de Agencia Española de Protección de Datos, heeft richtlijnen gepubliceerd over het anonimiseren van gegevens. Deze richtlijnen…
> Spain’s data protection authority, the Agencia Española de Protección de Datos, published guidance for anonymizing data. The guidance called for a trained professional to handle…
Personal data protection. Request for removal of search results from the Google Search search engine: the right to be forgotten. Articles 17 and 21 General Data Protection…
Buurgeschil. Verzoek om een hek te verwijderen is goedgekeurd. Inbreuk op eigendomsrecht en erfdienstbaarheid voor voetgangers en een oversteekplaats. Beroep tegen de…
Neighbor dispute. Claim to remove fence granted. Infringement of property right and easement of foot and crosswalk. Appeal of statute of limitations fails. Claim to remove cameras…
Bescherming van persoonlijke gegevens. Verzoek om verwijdering van zoekresultaten uit de zoekmachine Google: het recht om vergeten te worden. Artikelen 17 en 21 van de Algemene…
> The First-Tier Tribunal overturned portions of a 2020 enforcement notice by the U.K. Information Commissioner's Office against Experian, confirming the company's reliance on…
Het eerste beroepstribunaal heeft delen van een handhavingsbesluit uit 2020 van het Britse Information Commissioner's Office (ICO) tegen Experian vernietigd. Hierin werd bevestigd…
Meta plant om de gebruiksvoorwaarden en privacyverklaringen voor gebruikers in het Verenigd Koninkrijk te wijzigen, meldt Bloomberg. Gebruikers van Facebook, Instagram en WhatsApp…
> Meta plans to change its terms of service and privacy notices for U.K. users, Bloomberg reports. U.K. Facebook, Instagram and WhatsApp users will retain data rights under the…
Het anonimiseren van de naam van de beklaagde in een vonnis, AVG (Algemene Verordening Gegevensbescherming), schending van de privacy, immateriële schade.
anonymizing defendant's name in judgment, GDPR, invasion of privacy, intangible damages
21 Aw: Het portret, dat niet in opdracht is gemaakt, wordt gebruikt. Is de publicatie van het portret niet toegestaan omdat een gerechtvaardigd belang van de afgebeelde persoon…
21 Aw: portrait, which was not commissioned, is used. Is publication of the portrait not permitted because a reasonable interest of the person portrayed opposes it? No consent…
Credit Scoring Credit agency prohibited from collecting data via access requests and civil registries Two years ago, noyb filed a GDPR complaint against credit data broker KSV…
European Data Protection Day on 28 January commemorates the signing of the first pan-European data protection framework (Convention108) in 1981. Today, 42 years later, the GDPR is…
The Spanish Courts annulled a past decision by the Spanish DPA (AEPD). The AEPD had previously argued that Virgin telco, a telecommunications provider, had lawfully denied its…
Cookie Banners A task force within the European Data Protection Board (EDPB) issued a draft report in reaction to noyb's 700+ cookie banner complaints. The European Data…