Online & Mobile tracking Today, the French data protection authority has fined Fnac Darty (one of the largest electronics retailers in France) €7 million for illegally using third-party trackers on its mobile app without consent. The fine is the result of a noyb complaint filed in 2023. In addition to France, Fnac Darty is also active in countries such as Spain, Italy, Portugal, Belgium, and…
Online & Mobile tracking Today, noyb (in collaboration with Intérêt à Agir, DIPLab and Reversing.Works) has filed 5 complaints against Scale AI in France, Italy, the Netherlands and Austria. The US-based company operates an AI training platform named Outlier, which employs more than 900,000 “freelance” workers. Among its customers: Meta, OpenAI, Google – and the US government. However, it's not…
GDPR Policy On Wednesday, EU Member States approved a change to the GDPR that would put the profit-making interests of OpenAI, Anthropic, Google, Meta and SpaceX over European's fundamental right to data protection. According to the approved text, processing personal data “ in the context of AI ” should automatically be lawful. In particular, Big Tech would be able to use all personal data…
Political Microtargeting, Manipulation & Tracking Over three years ago, noyb filed complaints against several German political parties for unlawfully using political microtargeting during the 2021 federal election. Now, the Berlin Data Protection Authority has finally issued decisions concerning the Social Democrats (SPD), the Greens, the Left (Die LINKE), and the CDU. The conclusion: all of…
Background information Date of final decision: 2 October 2026 National case Controller: Xandr Inc. Legal References: Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data) Decision: Administrative fine Key words: Fines, Basic principles, Marketing, Online platforms Summary of the Decision Origin of the case The case started in 2020 when the Norwegian…
noyb remains one of the leading European forces pushing for the fundamental right to data protection for all users. To date, our legal work has resulted in administrative fines totalling €2 billion. In 2025, we not only filed several new GDPR complaints, but also began preparations for our first first collective redress case and dedicated significant resources to the EU Commission's Digital…
Brussels, 13 October – During its latest plenary, the EDPB has adopted statement 1/2026 on smart glasses and published the report “The connected gaze. Video recording, surveillance and administering evidence in the age of smart glasses” *, developed in the context of the Support Pool of Expert (SPE) programme **. As smart glasses become widely available and more frequently used, they raise…
GDPR Policy If the European Commission and the EU Member States have their way, the so-called Digital Omnibus will result in a fundamental change to EU privacy laws. But what about the European Parliament? To find out more, noyb has analysed more than 1,000 amendments that Members of Parliament (MEPs) have tabled for the GDPR and ePrivacy Directive to shed a light on their actions. This shows…
Online & Mobile tracking In 2020, noyb (in cooperation with the Norwegian Consumer Council) has filed a complaint against the online advertising company Xandr (now part of Microsoft) for processing personal data from the dating app Grindr. Now, the Norwegian Data Protection Authority has issued its decision – and fined Xandr € 8.5 million (NOK 92 000 000) for its GDPR violations. This decision…
Background information Date of final decision: 3 July 2026 National case Controller: Banco Bilbao Vizcaya Argentaria, S.A., Italian branch (BBVA) Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 21 (Right to object), Article 24…
Background information Date of final decision: 14 May 2026 National case Controller: Emirates Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected from the data subject)…
Background information Date of final decision: 6 August 2026 National case Controller: La Patria S.p.A. Legal Reference(s): Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject) and Article 15 (Right to access by the data subject)…
Background information Date of final decision: 23 September 2026 National case Controller: IQVIA Solutions Italy S.r.l Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 25 (Data protection by…
Background information Cross-border case Controller: Uber B.V Legal Reference(s): Article 22 (Automated individual decision making, including profiling) and Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine Key words: Automated decision making, profiling and online tracking, fines Summary of the Decision The Autoriteit…
Background information Date of final decision: 28/07/2026 National case Controller: Ministry of Social Cohesion and Family Affairs Legal Reference(s): Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 33 (Notification of a personal data breach to the supervisory authority) and Article 34 (Communication of a personal data…
Background information Date of final decision: 22/09/2026 National case Legal Reference(s): Article 32 (Security of processing) Decision: Administrative fine Key words: Cybersecurity, personal data breaches Summary of the Decision Origin of the case In August 2025, the IT service provider Miljödata was targeted in a cyberattack, during which a malicious actor gained access to a large volume of…
Background information Date of final decision: 21 September 2026 National case Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected…
Artificial Intelligence In a leaked document, the Irish Presidency proposes to EU Member States that the interest of OpenAI, Anthropic, Google, Meta and SpaceX to make profits should take precedence over the fundamental right to data protection. Use of personal data “in the context of AI” should automatically be lawful. There seems to be wide informal agreement by many Member States. In…
GDPR Policy For once, EU legislators have an opportunity to deliver genuine simplification for people: a solution to the ongoing issue of misleading cookie banners. As part of its highly controversial Digital Omnibus package, the EU Commission has proposed legally binding automated privacy signals. These would allow you to set your privacy preferences once, and very rarely see another banner.…
Credit Scoring Two weeks ago, noyb sent a cease-and-desist letter to SCHUFA regarding its shadow database. At the same time, we announced that we would bring an injunction should the credit reference agency refuse to comply with the requests set out therein. SCHUFA’s deadline has now expired. In a public statement, it has rejected the allegations. Therefore, it is now certain: noyb will file an…
Credit Scoring In June 2026, noyb brought an injunction against the unlawful data collection practices of the Austrian credit reference agency CRIF. In several unrelated cases, the Supreme Court (OGH) has now ruled in favour of noyb: CRIF’s current practice of collecting data from address publishers violates the GDPR principle of ‘purpose limitation’. This means that a key allegation in noyb ’s…
Credit Scoring In mid-July, investigations by NDR and the SZ revealed that the credit information agency SCHUFA stores millions of data records that should have been deleted long ago. It has since become clear that SCHUFA also uses this data for its customers’ ‘testing purposes’. Potentially, all 69 million people on whom SCHUFA holds data are affected. And SCHUFA continues to stonewall: Even in…
Cookie Banners Today, noyb has filed a complaint against the popular online dictionary dict.cc. The GDPR requires that consent is freely given, informed, specific and unambiguous. However, when visiting dict.c c, users are nudged into consenting to online tracking by a staggering 1,741 (!) “partners” with a single click. This makes it impossible for users to know exactly who has access to their…
Data Transfers On Monday, the US Supreme Court decided in Trump v. Slaughter that the US Federal Trade Commission (“FTC”) may not be independent anymore. Since 2000, the EU has relied on the “independent” FTC as the enforcer of EU-US deals on personal data. According to EU treaty law, such oversight must be independent. In the current EU-US deal, the European Commission relies on the independent…
GDPR Policy For years, users and many companies have been complaining about cookie banners. Even though this understandable frustration is mostly caused by misleading dark patterns used by the industry, these banners have become the symbol of what is perceived as excessive EU regulation. As part of the ‘Digital Omnibus’, the European Commission now finally wanted to get rid of cookie banners and…
Credit Scoring CRIF is one of the largest credit reference agencies in Austria. It has built up a largely unknown "shadow registry" containing the names, dates of birth and addresses of almost all adults in Austria. CRIF uses this data to assign people a score. For 90% of those affected, this score is based primarily on address, gender and age. Although this data does not allow for any real…
Forced Consent & Consent Bypass Today, the Norwegian Consumer Council ( Forbrukerrådet) and noyb have filed a complaint against the Norwegian news publisher Schibsted for implementing a “Pay or Okay” system across its products. Schibsted is one of the largest news publishers in the Nordics and owns well-known brands such as TV4, Aftenposten E24 and VG. The company’s introduction of “Pay or Okay”…
Cookie Banners The Austrian Broadcasting Corporation (ORF) must amend its cookie banner on ORF.at to bring it into line with the GDPR. This has now been decided by the Federal Administrative Court (BVwG), thereby upholding a decision made by the Austrian Data Protection Authority in 2024. Specifically, the ORF must ensure that the buttons to ‘accept’ or ‘reject’ tracking cookies are designed…
Data Subject Rights LinkedIn tracks the visits to profile pages. However, if you want to see who has visited your own profile, you have to pay. The Microsoft subsidiary uses these and other ‘insights’ as an incentive for people to sign up for its paid Premium membership. It is unclear whether this tracking of visitors is legal. What is clear, however, is that if this data is displayed as part of…
National Administrative Procedures and DPA inactivity Today, noyb has filed a lawsuit against the Hamburg data protection authority (DPA). While the authority considers the practices of the facial recognition search engine PimEyes to be illegal, it refuses to take effective action because the company seems to be based in Dubai. PimEyes systematically extracts biometric data from images on the…
Data Subject Rights The most commonly exercised right under the GDPR is the right of access to one’s personal data that is being processed by companies. After all, it’s often the prerequisite to know if there is inaccurate or unlawful personal data that needs to be corrected or deleted. However, a new analysis of noyb cases shows: Only 16.5% of all access requests noyb has sent to companies in…
Data Subject Rights The French Data Protection Authority (CNIL) fined Criteo, a major online advertisement and tracking company in Europe, €40 million for violating the GDPR. This decision is based on complaints filed by noyb and Privacy International in December 2018. The CNIL found that the company failed to comply with data subject rights under the GDPR and could not prove that they obtained…
GDPR Policy Ever since the European Commission has published its Digital Omnibus proposal, discussions about the workload the GDPR creates for businesses in Europe have intensified. Among other things, the Commission wants to restrict the Right of Access, allegedly to reduce the regulatory burden. But do these changes actually reflect the needs of privacy professionals working at companies? To…
GDPR Policy On 19 November 2025, the European Commission published its proposal for the "Digital Omnibus", subsequently sparking significant criticism and opposition. noyb conducted a thorough analysis of all the changes relevant to the GDPR and the ePrivacy Directive, which we firstly published a few days after the proposal was issued by the European Commission. The comprehensive report…
GDPR Policy The EDPB (combining all independent data protection authorities) and the European Data Protection Supervisor (EDPS) published a joint opinion expressing serious concerns about key elements of the proposed GDPR and ePrivacy changes in the so-called “ Digital Omnibus ” proposed by the European Commission. Specifically, the a uthorities strongly oppose the proposed narrowing of the…
Ever since the GDPR (General Data Protection Regulation) came into force in 2018, people in the European Union have stronger privacy and data protection. However, the law is far from perfect – and big tech companies, industry lawyers and lobbyists made sure to use every tool in their arsenal to either circumvent GDPR provisions (by misinterpretation) or to influence the public opinion about the…
Data Subject Rights noyb has scored another win in its proceedings against Microsoft 365 Education: The Austrian data protection authority (DSB) has decided that the company illegally installed cookies on the devices of a pupil without consent. According to Microsoft’s own documentation, these cookies analyse user behaviour, collect browser data and are used for advertising. Microsoft now has…
Credit Scoring An investigation into data flows at the Austrian credit agency CRIF has shed further light on the matter: most of the address data in the CRIF database comes from address brokers AZ Direct (Bertelsmann Group), Compass-Verlag and DPIT in Vienna. But where do these address traders get their data from? A new noyb evaluation involving more than 2,400 affected individuals shows that…
Online & Mobile tracking Austrian Supreme Court (OGH): Meta must provide full access to all personal data of user within 14 days, including the sources, recipients and purposes for which each information was used. All of Meta's claims of trade secrets or other limitations were rejected, leading to unprecedented access to the inner workings of Meta. Meta was also illegally collecting data from…
Online & Mobile tracking TikTok not only tracks its users while they are using the TikTok app itself, but it is increasingly integrated with many other websites and apps. For example, TikTok was able to track a person’s Grindr usage on his smartphone. However, that’s not all: In addition to tracking users across the digital space, TikTok also refuses to provide an interested users with a copy of…
Data Transfers Most EU-US data transfers are based on the “Transatlantic Data Privacy Framework” (TAFPF) or so-called “Standard Contract Clauses” (SCCs). Both instruments rely on fragile US laws, non-binding regulations and case law that is under attack – and is likely blown up in the next months. As instability in the US legal system becomes undeniable and the US shows open signs of hostility…
Cookie Banners So-called ‘Pay or Okay’ systems are on the rise in Europe. Instead of giving users a choice to either accept or reject ad tracking, Pay or Okay systems require a payment if you want to refuse to give your “consent”. This nudges 99.9% of users to consent, even if they actually don’t want to do so. Given the upcoming guidelines by the European Data Protection Board on this highly…
Cookie Banners Today, the French data protection authority CNIL has fined the French magazine publisher Conde Nast €750.000 for violating the consent requirements on its Vanity Fair website. noyb had originally filed a complaint against Conde Nast in 2019 (!). The decision by the French data protection authority noyb’s original complaints from 2019 Background. In December 2019, noyb had filed…
GDPR Policy This week the "Digital Omnibus" came out. noyb is right now working on an in-dept written analysis that we hope to publish the next days. As a preview, we brought together team members that worked on the various aspects of the Omnibus proposal by the European Commission in a video, to go into more details on select topics (the new personal data definition, the new research exemption,…
GDPR Policy This is a first reaction to a developing story. For any changes and/or updates to our statement, please re-check this page. Despite heavy criticism from civil society and large parts of the EU Parliament, the EU Commission has now published its proposal for the “Digital Omnibus”. Contrary to the Commission's official press release, these changes are not “ maintaining the highest…
GDPR Policy noyb has joined forces with EDRi and the Irish Council for Civil Liberties (ICCL) to send an open letter to the EU Commission. There are serious concerns about the potential threat that the internal draft for the Digital Omnibus poses to Europeans' fundamental rights. The Commission has secretly set in motion a potentially massive reform of the GDPR. If internal drafts become…
GDPR Policy As gradually leaked the last days by various news outlets, the EU Commission has secretly set in motion a potentially massive reform of the GDPR. If internal drafts become reality, this would have significant impact on people's fundamental right to privacy and data protection. The reform would be part of the so-called "Digital Omnibus" which was supposed to only bring targeted…
Biometric Data Today, noyb has filed a criminal complaint against Clearview AI and its managers. The facial recognition company is known for scraping billions of photos of Europeans and people around the world on the internet – and selling its facial recognition system to law enforcement and state actors. Several EU data protection authorities have already imposed fines and bans on Clearview AI.…
Data Subject Rights The Austrian Data Protection Authority ("DSB") issued a decision finding that Microsoft 365 Education illegally tracks students and uses student data for Microsoft's own purposes. The software giant also did not answer an access request related to Microsoft 365 Education, which is widely used in European schools. Instead, Microsoft tried to shift all responsibility to local…
Data Subject Rights Lithuania-based Whitebridge AI sells “reputation reports” on everyone with an online presence. These reports compile large amounts of scraped personal information about unsuspecting people, which is then sold to anyone willing to pay for it. Some data is not factual, but AI generated and includes suggested conversation topics, a list of alleged personality traits and a…
Credit Scoring noyb has scored a win in its complaint proceedings against the Austrian credit information agency KSV1870 and the energy provider Unsere Wasserkraft. The Austrian Data Protection Authority has found KSV1870's fully automated credit rating – which prevented the complainant from concluding an energy supply contract – to be unlawful. The DSB has also prohibited KSV1870 from carrying…
Credit Scoring Following an initiative by noyb, more than 2,400 affected individuals requested their data from the credit agency CRIF and have now received it. An evaluation by noyb shows that many well-known Austrian companies, such as Erste Bank, Verbund and Drei, evaluate their customers using CRIF data. Some companies, such as T-Mobile, the online retailer Otto, and the insurance company…
National Administrative Procedures and DPA inactivity The GDPR has been inadequately enforced for years. Despite 3,813 complaints, there were only 62 fines in Austria in 2024. However, the situation could become even worse: in its latest newsletter, the Data Protection Authority (DSB) announced further restrictions of its activities. The reason for this is significant budget cuts despite an…
National Administrative Procedures and DPA inactivity According to reports in the Irish Times and RTE, Niamh Sweeney, a former senior Meta lobbyist, is set to join the Irish Data Protection Commission (DPC) as a commissioner in October. The DPC is the EU lead privacy regulator for most US Big Tech (such as Google, Microsoft or Meta) and was already notoriously pro-business. Prior to being…
Forced Consent & Consent Bypass More than three years ago, noyb had filed a complaint against Google for sending unsolicited advertising emails directly to the inboxes of Gmail users. Contrary to EU law, the company never asked the people concerned for their consent. That's how the competent data protection authority sees it, too: Today, the CNIL has issued a decision siding with noyb – and…
Data Transfers Press Release by the General Court Background. Philippe Latombe, a French member of parliament, brought an action for annulment of the EU-US data transfer agreement (Transatlantic Data Protection Framework) before the General Court (the First Instance among the EU Courts). The CJEU (the second instance within the EU Courts) had previously ruled in “Schrems I” and “Schrems II” that…
Data Subject Rights noyb has achieved a win against YouTube, the video platform provided by Google. After five and a half years, the Austrian data protection authority (DSB) has finally issued a decision siding with noyb – and ordering YouTube to comply with the complainant’s access request in accordance with Article 15 GDPR. Until now, the company withheld a large amount of data, including…
Cookie Banners The Austrian Federal Administrative Court (BVwG) has confirmed an earlier decision by the Austrian Data Protection Authority (DSB) that the Austrian newspaper DerStandard violated the GDPR when introducing "Pay or Okay”. The DSB and the Court both held that users must be able to selectively consent or object to each processing purpose. This case will now likely hit the Austrian…
Artificial Intelligence Meta has recently started using the personal data of Europeans for AI training. Contrary to its GDPR obligations, Meta hasn’t asked for consent in advance. Instead, the company claims to have a ‘legitimate interest’ outweighing the fundamental right to privacy. A key argument in favour of such a ‘legitimate interest’ is the reasonable expectations of users. This begs the…
Almost 7 years after the GDPR came into force, noyb remains to be one of the leading European forces pushing for the fundamental right to data protection for all users. To date, our legal work has resulted in administrative fines totalling €1.69 billion. Our achievements in 2024 prove once again that we can make an impact: In addition to filing 36 new complaints, we also obtained a number of new…
Forced Consent & Consent Bypass So-called ‘Pay or Okay’ systems are on the rise in Europe. First introduced by newspapers in Austria and Germany, Meta adopted the approach for Instagram and Facebook in 2023. By now, many websites across Europe are using similar systems. Instead of giving users a genuine choice whether to accept or reject ad tracking, ‘Pay or Okay’ systems ask for a payment if…
Data Subject Rights Today, noyb has filed GDPR complaints against AliExpress, TikTok and WeChat. All three tech companies have failed to comply with access requests under Article 15 GDPR. This makes it impossible for European users to exercise their fundamental right to privacy, to find out how their personal data is being processed – and if the companies actually comply with other GDPR…
Artificial Intelligence In December 2023, the dating platform Bumble introduced so-called AI Icebreakers to the “Bumble for Friends” section of the app. Powered by OpenAI’s ChatGPT, the feature is designed to help you start a conversation by providing an AI-generated message. In order to do this, your personal profile information is fed into the AI system without Bumble ever obtaining your…
Forced Consent & Consent Bypass In August 2021, noyb had filed several complaints against news sites using unlawful ‘Pay or OK’ systems with German data protection authorities (DPAs). Despite the fact that only about 3 to 10% of people want tracking for personalised advertising, these systems lead to consent rates of more than 99%. Almost four years after the filing of the complaints, the DPAs…
Forced Consent & Consent Bypass Meta announced today that it also wants to introduce ads on WhatsApp, which will be based on personal data from Facebook and Instagram. This further integrates WhatsApp into other Meta services - an originally independent app, which initially was available for just $1 per year without ads or data usage. This also means that Meta is consolidating its social…
Credit Scoring The credit agency CRIF collects personal data from millions of people in Austria and assesses their creditworthiness with a score between 250 and 700. For most people, this score is based on just a few pieces of information, such as address, age and gender. If the score is too low, those affected are unable to sign contracts with many companies, such as mobile phone providers like…
Artificial Intelligence Today, a German Region Court in Cologne had to decide on an interim injunction against Meta. The German Consumer Rights Organisation "Verbraucherzentrale NRW" has brought the case, arguing that Meta violates the GDPR when sucking up decades of user data without consent to train its AI. VZ NRW brought an "interim" case in an attempt to prevent Meta from starting AI…
National Administrative Procedures and DPA inactivity The EU’s trilogue negotiations for a Procedural Regulation that should harmonise and accelerate enforcement of the General Data Protection Regulation (GDPR) will probably have the last meeting this Wednesday (21 May). However, the proposal risks undermining the GDPR's enforcement by introducing excessively long deadlines and overly complex…
Forced Consent & Consent Bypass Meta has announced it will use EU personal data from Instagram and Facebook users to train its new AI systems from 27 May onwards. Instead of asking consumers for opt-in consent, Meta relies on an alleged 'legitimate interest' to just suck up all user data. The new EU Collective Redress Directive allows Qualified Entities such as noyb to issue EU-wide injunctions.…
Forced Consent & Consent Bypass On 14 April, Meta announced that it would use the personal data of European users for artificial intelligence (AI) training in the future. Starting on 27 May, the company will use all posts published on Instagram and Facebook for AI training. The company falsely claims to have a legitimate interest in this extensive data use – even though it should actually ask…
Online & Mobile tracking Today, noyb filed a complaint against the French video game developer and publisher Ubisoft (known for Assassins Creed, Far Cry, Prince of Persia). The company forces its customers to connect to the internet every time they launch a single player game. This is the case even if the game doesn’t have any online features. This allows Ubisoft to collect people’s gaming…
National Administrative Procedures and DPA inactivity As of 2018, the GDPR is supposed to ensure that Europeans enjoy privacy rights throughout the entire EU. However, when people's rights are violated by companies based in another EU/EEA Member State, complaints are dealt with through a complex "cooperation mechanism" between the Data Protection Authority (DPA) in the users' Member State and…
Data Subject Rights In most countries, the government knows when you were born, your social security number, where you live, how much you earn and how much your house is worth. Sweden is a bit different though. There, the tax authority doesn’t just use this information for administrative purposes – but sells it to data brokers who publish it online. This is a violation of EU law. Earlier this…
Artificial Intelligence OpenAI’s highly popular chatbot, ChatGPT, regularly gives false information about people without offering any way to correct it. In many cases, these so-called “hallucinations” can seriously damage a person’s reputation: In the past, ChatGPT falsely accused people of corruption, child abuse – or even murder. The latter was the case with a Norwegian user. When he tried to…
Data Subject Rights Nowadays, more and more banks set their interest rates automatically, and without any human intervention. But even the smallest inaccuracies can cost consumers thousands of additional euros. While EU law allows the use of such an automatic system in certain circumstances, companies must follow strict rules to protect people’s fundamental right to privacy. Banks, for example,…
Political Microtargeting, Manipulation & Tracking In March 2023, noyb filed complaints against several German political parties: During the 2021 elections, CDU, AfD, SPD, Bündnis 90/Die Grünen, Die Linke and the Ecological Democratic Party illegally used political microtargeting to attract voters. Now, almost two years later, we are just one day away from the next federal election. However, the…
Data Subject Rights The highly popular smartphone app WetterOnline shares the personal data of its users with hundreds of third-party companies for advertising purposes. Until a few days ago, this included highly precise location data which can be used to derive a user's place of residence and workplace or even a visit to a military base. This data has ended up on marketplaces where it's openly…
National Administrative Procedures and DPA inactivity Today, the EU's General Court held that the Irish DPC acted unlawful when it refused to investigate a noyb complaint. The European Data Protection Board (EDPB) held in December 2022 that Meta illegally used the personal data of users for advertising without consent under Article 6(1) GDPR. The EDPB also decided that the DPC should have also…
National Administrative Procedures and DPA inactivity When the General Data Protection Regulation (GDPR) came into force in 2018, it ushered in a new era of data protection in the EU. At least on paper. Consumers were given the tools to stand up for their fundamental rights, while authorities received serious investigatory powers and the ability to sanction breaches with hefty fines. Nearly 7…
Data Transfers Since the Snowden disclosures we know that the US engages in mass surveillance of EU users by scooping up personal data from US Big Tech. The "Privacy and Civil Liberties Oversight Board" (PCLOB) is the key US oversight authority for these laws. US media now reports, that Democratic members of the PCLOB got removed and their email accounts shut down. This brings the number of…
Data Transfers Today, noyb has filed GDPR complaints against TikTok, AliExpress, SHEIN, Temu, WeChat and Xiaomi for unlawful data transfers to China. While four of them openly admit to sending Europeans’ personal data to China, the other two say that they transfer data to undisclosed “third countries”. As none of the companies responded adequately to the complainants’ access requests, we have to…
In the judgment C-416/23, the Austrian Data Protection Authority (DSB) received a slap in the face from the CJEU. The authority has – arbitrarily – set the number of complaints that data subjects can file at a maximum of two per month, even if one is affected by GDPR violations almost daily. The CJEU has now made it clear: as long as you do not file abusive complaints, all users have the right…
Biometric Data Today, noyb filed a GDPR complaint against Ryanair. Booking a flight on the airline’s website not only requires a mandatory account. New customers must also go through a verification process which, for many people, involves invasive biometrics. There is no reasonable justification for such a system. Instead, it appears that Ryanair is willingly violating its customers’ right to…
Data Subject Rights noyb has achieved a win against Netflix. Almost five years after the complaint has been filed, the Dutch data protection authority (DPA) has finally issued a decision. The authority is imposing a fine of €4.75 million against the streaming provider because it failed to adequately inform customers about what it does with their data. Press release from the Dutch DPA Original…
Political Microtargeting, Manipulation & Tracking noyb win against the European Commission: The EDPS (European Data Protection Supervisor) has issued a decision finding that the European Commission has illegally targeted advertising at citizens using "sensitive" personal data on their political views. Decision by the EDPS Complaint filed with the EDPS in 2023 Related noyb complaints in Germany…
Forced Consent & Consent Bypass Today, noyb has filed a complaint against the social media platform BeReal over the latest “dark pattern” to get consent. When people open the app, they are confronted with a pop-up asking them to say “yes” or “no” to the use of their personal data for advertising purposes. So far so good, but BeReal wants to force a specific choice: if users click “accept”, they…
Data Subject Rights noyb is now approved as a so-called "Qualified Entity" to bring collective redress actions in courts throughout the European Union. Such action under Directive (EU) 2020/1828 can either be an "injunction" or a "redress" measure. "Injunctions" generally prohibit a company from engaging in illegal practices, including any GDPR violations. "Redress" measures allow a European…
Data Subject Rights noyb welcomes yesterday's leading decision of the German Federal Court of Justice on claims in connection with a data protection incident at Facebook Copyright for header picture above: Steffen Prößdorf, CC BY-SA 4.0 <https://creativecommons.org/licenses/by-sa/4.0>, via Wikimedia Commons Press Release by the BGH (in German) Video of the Ruling (in German) Report by German…
Forced Consent & Consent Bypass In the battle over the illegal use of personal data for advertisement, Meta has announced another variation that is not "Yes or No" consent: This time Meta will try "less personalized" ads, which may also annoy users into consenting. However, since 2018 the GDPR requires consent for advertisement. Until 2023 Meta has simply ignored that requirement. Last year Meta…
Online & Mobile tracking Today, noyb filed a complaint against the social media platform Pinterest. Most users probably know it as a visual mood board and use it to find ideas and inspiration. Advertisers, on the other hand, use the platform to push their products on consumers. Unsurprisingly, Pinterest’s business model is also based on personalised advertising and the associated user tracking.…
Online & Mobile tracking In today's ruling in C-446/21 (Schrems v. Meta), the Court of Justice of the European Union (CJEU) has fully backed a lawsuit brought against Meta over its Facebook service. The Court decided on two questions: First, massively limiting the use of personal data for online advertisements. Secondly, limiting the use of publicly available personal data to the originally…
Online & Mobile tracking Today, noyb filed a complaint against Mozilla for quietly enabling a supposed “privacy feature” (called Privacy Preserving Attribution) in its Firefox browser. Contrary to its reassuring name, this technology allows Firefox to track user behaviour on websites. In essence, the browser is now controlling the tracking, rather than individual websites. While this might be an…
Forced Consent & Consent Bypass Following several noyb complaints from 2023, the Belgian data protection authority has ordered four major Belgian news sites to bring their cookie banners into GDPR compliance. Specifically, De Standaard, Het Nieuwsblad, Het Belang van Limburg and Gazet van Antwerpen must add a “reject” button to the first layer of their cookie banners. In addition, the news sites…
Profiling & Automated Decision Making Today, noyb lodged a complaint with the Austrian data protection authority against the credit reference agency KSV1870 and the energy supplier ‘Unsere Wasserkraft’. When attempting to conclude a contract with Unsere Wasserkraft, new customers are subjected to a fully automated credit check by KSV without being asked. If you are assigned a supposedly…
Data Security In early May 2024, the European Parliament informed its staff of a massive data breach in the institution’s recruiting platform (called “PEOPLE”). The breach affected the personal data of more than 8,000 staff. This included ID cards and passports, criminal record extracts, residence documents and even sensitive data such as marriage certificates that reveal a person’s sexual…
Data Subject Rights Greek supermarket chain Alfa Vita (AB) runs a loyalty card program, allowing the collection of personal data of shoppers. Still, the company can’t even comply with baseline GDPR rights. When the complainant requested access to her data, AB left out most of the personal data it processed. noyb now filed a complaint with the Greek DPA. Complaint against Alfa Vita (EL) Complaint…
Artificial Intelligence Recently, Twitter International (now re-branded as “X”) began unlawfully using the personal data of more than 60 million users in the EU/EEA to train its AI technologies (like "Grok") without their consent. Unlike Meta (which recently also had to stop AI training in the EU), Twitter did not even inform its users in advance. This went too far even for the Irish Data…
Data Subject Rights Contrary to EU law, the Swedish Data Protection Authority (IMY) regularly refuses to properly handle complaints from data subjects. Even after a ruling by the Supreme Administrative Court of Sweden, the IMY frequently just forwards a complaint to the company that illegally processes personal data - and then immediately closes the case without investigating. However, the GDPR…
Forced Consent & Consent Bypass Following a complaint by noyb, the Hamburg data protection authority declared the use of controversial ‘Pay or OK’ systems to be permissible. However, the procedure raises considerable questions: Although the authority was in active dialogue with news magazine DER SPIEGEL, it did not hear the person concerned once during the proceedings. Many relevant facts were…
In 2023, noyb continued to be one of the major European forces pushing for the fundamental right to data protection for all users. Our achievements this year prove once again that we can make an impact: In addition to filing more than 40 new complaints, 2023 was a year of major decisions in noyb cases that resulted in significant fines against several companies. Annual Report 2023 Our cases in…
The European Parliament and the Council of the EU have now published their amendments to the Commission's draft GDPR procedural regulation. We have analysed the two versions and prepared an initial overview (video and presentation). Background. Under the GDPR, data protection authorities (DPAs) from different member states are supposed to work together when dealing with user complaints and…
Cookie Banners Following several hundred noyb complaints against companies that use questionable consent banners, the European Data Protection Board established a "cookie banner taskforce" in September 2021. In January 2023, the taskforce then published a report offering its opinion and recommendations regarding the different kind of violations found in consent banners. With its new Consent…
Data Subject Rights Advertising broker Xandr (a Microsoft subsidiary) collects and shares the personal data of millions of Europeans for detailed targeted advertising. This allows Xandr to auction off advertising space to thousands of advertisers. But: although only one ad is ultimately shown to users, all advertisers receive their data. This may include personal details concerning their health,…
Online & Mobile tracking Today, a Norwegian court has confirmed that Grindr violated the GDPR by sharing user data with advertisers. This also confirms that Grindr must pay a fine of NOK 65 million (approximately € 5.7 million). The case was based on a complaint by the Norwegian Consumer Council (Forbrukerrådet), which was supported by noyb. Read more here: Press release from the Norwegian…
Artificial Intelligence In response to 11 noyb complaints, the DPC has announced (late Friday afternoon) that Meta has committed to the DPC that it will not process EU/EEA user data for undefined "artificial intelligence techniques". Previously, Meta had argued that it had a "legitimate interest" in doing so. (Some) users were only notified about the change and given a (misleading and…
Forced Consent & Consent Bypass After years of growing criticism over invasive ad tracking, Google announced in September 2023 that it would phase out third-party cookies from its Chrome browser. Since then, users have been gradually tricked into enabling a supposed “ad privacy feature” that actually tracks people. While the so-called “Privacy Sandbox” is advertised as an improvement over…
Artificial Intelligence Over the past few days, Meta has informed millions of Europeans that its privacy policy is changing once again. Only on closer inspection of the links in the notification did it become clear that the company plans to use years of personal posts, private images or online tracking data for an undefined "AI technology" that can ingest personal data from any source and share…
Forced Consent & Consent Bypass noyb has today lodged a GDPR complaint against Kurier. Just a few months ago, users were forced to consent to Google and other tracking cookies when visiting the website of the Austrian daily newspaper. In doing so, the company clearly violated the GDPR, a fact that was also confirmed by the Austrian data protection authority: The latter had already banned the…
Data Subject Rights In the wake of the pandemic, schools in the European Union have increasingly begun to implement digital services for online learning. While these modernisation efforts are a welcome development, a small number of big tech companies immediately tried to dominate the space – often with the intention of getting children used to their systems and creating a new generation of…
Artificial Intelligence In the EU, the GDPR requires that information about individuals is accurate and that they have full access to the information stored, as well as information about the source. Surprisingly, however, OpenAI openly admits that it is unable to correct incorrect information on ChatGPT. Furthermore, the company cannot say where the data comes from or what data ChatGPT stores…
Online Advertising CJEU press releases (look for C-446/21 - Schrems) Full AG Opinion Katharina Raabe-Stuppnig, lawyer representing Mr Schrems: "We are very pleased by the opinion, even though this result was very much expected." Use of data for advertising must be limited by time, type and source. So far, Meta uses all the data it has ever collected for advertising. For example, Facebook user…
Forced Consent & Consent Bypass Today, the EDPB has issued its first decision on "Pay or Okay" in relation to large online platforms such as Instagram and Facebook, as first reported by Politico. This decision prohibits Meta from using an unlawful consent request processing personal data. It seems that by now, Meta has run out of options to continue using people's data for advertising in the EU…
Forced Consent & Consent Bypass So-called pay or consent systems are on the rise in Europe. First introduced by journalistic websites that were suffering from the loss of advertising revenue to big tech platforms, Meta adopted the approach for Instagram and Facebook in November 2023. In this video, we explain what this is all about and why this approach is dangerous for free consent online. Pay…
Forced Consent & Consent Bypass The European Data Protection Board (EDPB) will soon decide about the future of free consent online. Following Meta’s introduction of a “Pay or Okay” system last year, the EDPB will issue a binding opinion. Should the approach be legitimised for Meta, companies across all industries could follow the social media giant’s lead. This could ultimately lead to the…
National Administrative Procedures and DPA inactivity Would you like a license to break the law? Sweden may be your dream destination: Thanks to a loophole in national law, large data brokers like MrKoll can simply obtain a “media licence”, exempting their entire business from all obligations under the EU’s strict privacy laws. This deprives millions of Swedes of their fundamental right to…
Credit Scoring Today, noyb has filed a complaint and report against the German credit agency SCHUFA with the Hessian data protection authority. The company appears to be making millions of euros by selling people in Germany their own data. With the help of manipulative designs, people are prevented from obtaining a free copy of their data in accordance with Article 15 GDPR – even though they…
Forced Consent & Consent Bypass The European Data Protection Board (EDPB) will soon issue what is likely to be its most significant opinion to date: It will determine whether Europeans continue to have a realistic option to protect their right to privacy online. In November 2023, Meta adopted a “Pay or Okay” approach. Since then, users have been forced to either pay a ‘privacy fee’ of € 251.88…
Credit Scoring noyb has scored a stage victory in its proceedings against the credit reference agency CRIF and the address trader Acxiom in Germany. The companies are illegally trading the personal data of millions of Germans. A little over two years ago, noyb therefore filed a complaint. Now the Bavarian data protection authority has ruled that CRIF has misused the purchased data – and…
When the GDPR came into force in 2018, the new and shiny data protection law was hailed as a shift towards stricter enforcement – ensuring that in the EU, the fundamental right to data protection does not only exist on paper. To mark this year’s Data Protection Day on 28 January, noyb conducted a survey among more than 1000 data protection professionals working in European companies. This…
Forced Consent & Consent Bypass Since the beginning of November, Instagram and Facebook users who don’t want to be tracked have to pay a “privacy fee” of up to € 251.88 per year. While one (free) click is enough to consent to being tracked, users can only withdraw their consent by going through the complicated process of switching to a paid subscription. This is illegal, as the GDPR clearly…
Credit Scoring Today, noyb filed a complaint and report against the creditors’ association KSV1870 with the Austrian data protection authority. Although Article 15 GDPR stipulates that the right of access must be free of charge, KSV is making huge profits from it. They use misleading website designs to urge people to purchase a high-priced "InfoPass" instead of getting a free copy of their data.…
Political Microtargeting, Manipulation & Tracking Today, noyb filed a complaint against X (Twitter) for unlawfully using the political views and religious beliefs of its users for targeted advertising. The company used this specially protected data to determine whether people should or should not see an ad campaign by the EU Commission’s Directorate General for Migration and Home Affairs, which…
Credit Scoring Note: The judgments are not connected to noyb cases CJEU landmark rulings on “credit ranking” and review of DPAs The European Court of Justice (CJEU) today issued two landmark judgments in proceedings against the German credit reference agency SCHUFA, which previously enjoyed considerable freedom in Germany. The CJEU confirmed that national courts have extensive powers to…
Credit Scoring noyb has filed a lawsuit against the credit reference agency CRIF GmbH and the address trader AZ Direct. The companies secretly trade the address data of almost every adult in Austria. By doing so, CRIF obtains information that was actually collected for advertising purposes - in order to calculate credit ratings. As the Austrian data protection authority confirmed in two…
Forced Consent & Consent Bypass Today, noyb filed a complaint against Meta with the Austrian data protection authority. European users now have the “choice” to either consent to being tracked for personalized advertising – or pay up to €251.88 a year to retain their fundamental right to data protection on Instagram and Facebook. Not only is the cost unacceptable, but industry numbers suggest…
Political Microtargeting, Manipulation & Tracking noyb files complaint against EU Commission over targeted chat control ad campaign Today, noyb filed a complaint against the EU Commission’s Directorate General for Migration and Home Affairs. In September 2023, the Commission used unlawful micro-targeting on Twitter (X) to promote its heavily criticized chat control regulation. It seems that the…
Credit Scoring Address trader sues German DPA to prevent noyb from accessing files Two years ago, noyb filed a complaint against the address trader Acxiom and the credit reference agency CRIF in Germany. Although there is strong evidence that the companies’ large-scale trade with people’s personal data violates the GDPR, the case is still pending with the Bavarian and Hessian DPA. So in spring…
Data Subject Rights Streaming service DAZN took almost five years to answer a simple access request In January 2019, noyb filed two complaints against the streaming ser vice DAZN for not responding to access requests. In theory, these sound like straightforward cases. In reality, they were not closed until September 2023 – that is, after more than 4,5 years, the involvement of the Austrian…
Forced Consent & Consent Bypass Meta (Facebook / Instagram) to move to a "Pay for your Rights" approach The Wall Street Journal reported that Meta plans to move to a "Pay for your Rights" model, where EU users will have to pay $ 168 a year (€ 160 a year) if they don't agree to give up their fundamental right to privacy on platforms such as Instagram and Facebook. History has shown that Meta's…
Online & Mobile tracking € 5,8 million fine for Grindr – appeal by Grindr failed In 2020, the Norwegian Consumer Council (NCC) filed a complaint to the Norwegian Data Protection Authority against the dating app Grindr for breach of the General Data Protection Regulation. noyb has assisted the NCC in its legal analysis. The Norwegian Privacy Appeals Board (Personvernnemnda) today announced that…
Forced Consent & Consent Bypass Today, noyb filed three complaints in France against Fnac (the largest electronics store in France), the real estate app SeLoger and the fitness app MyFitnessPal. The companies’ apps illegally access and share users’ personal data with third parties for sophisticated analytics as soon as the apps are opened. Users don’t even have the choice to consent to or…
Forced Consent & Consent Bypass Today, noyb filed three complaints against Fitbit in Austria, the Netherlands and in Italy. The popular health and fitness company, acquired by Google in 2021, forces new users of its app to consent to data transfers outside the EU. Contrary to legal requirements, users aren’t even provided with a possibility to withdraw their consent. Instead, they have to…
Annual Report 2022 out now! Annual Report 2022 In 2022, noyb continued its longstanding fight for users’ right to privacy. Although the GDPR always foresaw a strong role for non-profits in this regard, we still see a lack of enforcement by data protection authorities (DPAs). That's why our main effort in 2022 has been to push forward our nearly 800 preexisting cases, which were filed in previous…
Data Transfers 23 years of illegal data transfers due to inactive DPAs and new EU-US deals In two landmark rulings in 2015 and 2020, the Court of Justice of the European Union (CJEU) declared EU-US data transfers illegal. These decisions are retroactive, which means there was no legal basis for said transfers between the year 2000 and 2023. Nevertheless, most EU companies kept using services…
Forced Consent & Consent Bypass Meta apparently switches to consent for behavioral ads after five years of litigation After more than five years of extensive litigation by noyb, the German Kartellamt and decisions by the EDPB and CJEU it seems that Meta finally complies with EU privacy laws. The company announced it will ask its users for consent before showing behavioral ads in the future. It…
Biometric Data Today, noyb filed a complaint against Ryanair. When booking through an online travel agent and not directly on its website or app, Europe’s biggest airline requires a part of its customers to go through a “verification process” involving invasive facial recognition. There is no reasonable justification for Ryanair to implement this system. Instead, it seems like the airline is…
Cookie Banners Unlawful Cookie Banners: Belgian DPA let news outlets buy themselves free from GDPR compliance Belgian news outlets relying o n illegal cookie banners paid € 10.000 in a settlement with the Belgian Data Protection Authority (DPA), which decided to close the case without ordering them to fix the unlawful banners. In essence, the payment was freeing the companies from the duty to…
Forced Consent & Consent Bypass Norwegian DPA temporarily bans behavioral advertising on Facebook and Instagram Following a CJEU ruling that declared Meta/Facebook’s GDPR approach largely illegal, the Norwegian DPA ( Datatilsynet) is the first national data protection authority declaring behavioral advertising on the company’s platforms Facebook and Instagram illegal. Datatilsynet imposes a…
Cookie Banners „Pay or Okay“ on tech news site heise.de illegal, decides German DPA. Major implications for many other German news pages. One of the largest German-language tech news sites, heise.de, made users choose between paying for a monthly subscription or having their personal data processed for advertising and many other purposes. The Data Protect ion Authority of Lower Saxony (LfD)…
Data Transfers Open letter: Repeated false allegations of a “business model” when citizens exercise their r ights Instead of focusing on the legal matters of the supposedly new EU-US "Data Privacy Framework", EU Commissioner Didier Reynders used an official press conference of the European Commission on Monday, to discredit the work of civil rights organizations like noyb. This is intolerable…
Data Transfers New Trans-Atlantic Data Privacy Framework largely a copy of "Privacy Shield". noyb will challenge the decision. Third attempt of the European Commission to get a stable agreement on EU-US data transfers will be likely back at the Court of Justice (CJEU) in a matter of months. The allegedly "new" Trans-Atlantic Data Privacy Framework is largely a copy of the failed "Privacy…
National Administrative Procedures and DPA inactivity GDPR Procedures Regulation: Commission Proposal is an attack on users' rights in GDPR procedures Today the EU Justice Commissioner Reynders has issued a proposal to fix the (lack of) cooperation between some Data Protection Authorities (DPAs). Currently the GDPR only tells DPAs to cooperate, but lacks the details about how this cooperation…
The GDPR allows for six legal bases to process personal data. In the case Meta v Bundeskartellamt, the CJEU has today ruled on all of them - further clarifying the interpretation of the GDPR. The CJEU has largely closed the doors for Meta to use personal data beyond what is strictly necessary to provide the core products (such as messaging or sharing content) - all other processing (like…
Data Transfers noyb win: First major fine (€ 1 million) for using Google Analytics Following noyb’s 101 complaints on unlawful EU-US data transfers, the Swedish data protection authority (IMY) issued decisions against four companies and imposed a fine of 12 mio SEK (1 mio Euro) against telecommunication provider Tele2 and 300.000 SEK against online retailer CDON for using Google Analytics on…
Ireland makes questionable GDPR cases 'confidential'. Irish DPC will likely use Section 26A to muzzle criticism. Despite profound criticism by civil society ( ICCL, Amnesty, EDRi, BEUC) and hard push back in the Irish Parliament, Ireland has passed a law that will allow the Irish Data Protection Commission (DPC) to criminalize anyone sharing information about pending procedures. While the law is…
National Administrative Procedures and DPA inactivity Ireland: Reporting about DPC procedures soon a crime! Irish Parliament can stop last-minute "gag order" amendment. In a surprising last-minute amendment to the otherwise innocuous " Courts and Civil Law (Miscellaneous Provisions) Bill 2022 " from September 2022 the Irish Government added a provision that would allow the Irish DPC to declare…
Profiling & Automated Decision Making Today, noyb filed a complaint against TeleSign, a US company which profiled millions of phone users. TeleSign generates a “reputation score” and sells its services to various clients like TikTok, Microsoft or Salesforce. TeleSign secretly received the mobile phone data from BICS, a Belgian company that provides interconnection services for many mobile phone…
Data Subject Rights The French Data Protection Authority (CNIL) fined Criteo, a major online advertisement and tracking company in Europe, €40 million for violating the GDPR. This decision is based on complaints filed by noyb and Privacy International in December 2018. The CNIL found that the company failed to comply with data subject rights under the GDPR and could not prove that they obtained…
Data Subject Rights Following a noyb complaint and litigation over inactivity, the Swedish Data Protection Authoirty (IMY) has issued a fine of 58 Mln Swedish Crown (about € 5 Million) against Spotify. While users have a right to get access to all their data and information on the use of their data, Spotify did not fully comply with this obligation. The IMY was in charge of the case because…
Credit Scoring noyb 's legal proceedings against the credit reporting agency CRIF are uncovering a multitude of legal violations and cynical interpretations of the GDPR, exposing a swamp of misconduct. These violations include incorrect credit scores, unlawful data collection, and deliberate withholding of information when data subjects submit requests to the credit agency. CRIF's tactics rely…
5 Years of the GDPR: National Authorities let down European Legislator. 85% of noyb cases not decided. On 25 May 2018, the GDPR came into force. While the contents of EU data protection rules stayed largely the same, the alleged big change was the GDPR's strict enforcement. 5 years later, national authorities and courts largely leave the European legislator in the lurch – despite a budget of…
Data Transfers Today, a decade-long (2013 - 2023) case on Meta's involvement in US mass surveillance has lead to a first direct decision. Meta must stop any further transfers of European personal data to the United States, given that Meta is subject to US surveillance laws (like FISA 702). The EDPB had largely overturned the Irish DPC's decision, insisting on a record fine and that previously…
Political Microtargeting, Manipulation & Tracking Data Breach in Malta: Company must disclose source within 20 days or face penalties The Maltese Data Protection Authority (IDPC) has taken decisive action against C-PLANET, the IT company responsible for a voter data breach in Malta. Following a second complaint filed by noyb, the IDPC has ordered C-PLANET to reveal the specific details regarding…
Clearview AI data use deemed illegal in Austria, however no fine issued The Austrian data protection authority has decided: Clearview AI, the company that sells facial recognition software to law enforcement agencies in the U.S. is no longer allowed to process biometric data of the complainant and must delete their existing data. The US based company scrapes photos from websites to create a…
The Court of Justice confirmed that there is no "threshold" for GDPR damages, contrary to national courts. Today, the Court of Justice of the European Union (CJEU) issued the first judgment on emotional damages under the GDPR, confirming that the GDPR does not require a "threshold" for damages. The other demands by the Court are the typical requirements for any damages claim. Press Release by…
noyb wins at the CJEU: Right to information must include context - in some cases also documents and database excerpts Yesterday, the Court of Justice of the European Union (CJEU) ruled that users must not only receive a copy of their raw data, but also the context of the data in an understandable way. This can also include the documents that contain personal data. The term "copy" means true and…
Cookie Banners "Pay or Okay" - the beginning of the end? "PUR Abo" on derStandard.at illegal according to Austrian DPA After the GDPR came into force, the Austrian daily newspaper "Der Standard" launched an attempt to circumvent the law: readers had to choose between their data being processed or buying a subscription. Any initial complaints were ignored by the Austrian Data Protection Authority…
Forced Consent & Consent Bypass No bullsh*t opt-out: Free noyb tool for quick and broad Facebook objections is now online! As reported last week, Meta switched the legal basis for targeting advertising from one ille g al practi ce to the next: Instead of giving users a yes / no option ("consent") as foreseen by the GDPR, Meta now (unlawfully) claims to have ‘legitimate interest’ in tracking…
Forced Consent & Consent Bypass Meta (Facebook, Instagram) switching to "Legitimate Interest" for ads after noyb win. noyb will take immediate action to stop this illegal practice As reported by the Wall Street Journal, Meta (Facebook and Instagram) is switching from an illegal contract to an equally illegal basis "legitimate interests" for advertisement, after noyb won a series of complaints…
Credit Scoring The frequently criticized credit referencing agency CRIF GmbH has collected addresses, dates of birth and names of almost all Austrians in order to calculate "creditworthiness values" without consent or any other legal basis. The Austrian Data Protection Authority (DPA) has now ruled in a test case that this data was processed illegally. Millions of data records must be deleted.…
Political Microtargeting, Manipulation & Tracking Today, noyb filed a series of complaints against several German political parties. The parties had used microtargeting on Facebook during the 2021 federal election to identify potential voters and target them with personalized election promises. However, political opinions are particularly protected under the GDPR, which makes the parties'…
Cell phone not personal enough for GDPR protection?! Contradictory decision from the Austrian Federal Administrative Court (BVwG): Cell phone traffic and location data are particularly sensitive data that require additional protection, but at the same time they are not personal data at all. According to the BVwG, the mobile phone provider A1 may refuse to provide information about traffic and…
Data Transfers Austrian DSB: Meta Tracking Tools Illegal In a groundbreaking decision in one of noybs 101 complaints, the Austrian Data Protection Authority (DSB) has decided that the use of Facebook’s tracking pixel directly violates the GDPR and the so-called “Schrems II” decision on transatlantic data flows. In 2020, the Court of Justice (CJEU) decided that the use of US providers violates…
Data brokers: Identification possible to sell ads, not to exercise fundamental rights Today, noyb filed a series of complaints against websites and data brokers that did not correctly address access requests using cookies as an authentication factor. The companies had shown obstructive approaches when authenticating users; ranging from denying the right to access, to requiring additional…
Credit Scoring Credit agency prohibited from collecting data via access requests and civil registries Two years ago, noyb filed a GDPR complaint against credit data broker KSV 1870. The Austrian credit reporting agency stored unsolicited data from previously unknown individuals who exercised their legal right to access their data. Now, the Austrian Data Protection Authority (DSB) published their…
Data Protection Day: Are Europeans really protected? European Data Protection Day on 28 January commemorates the signing of the first pan-European data protection framework (Convention108) in 1981. Today, 42 years later, the GDPR is seen as the central law in European data protection and is meant to enable citizens to exercise their fundamental right to privacy. Initially hailed - and feared -…
Location data is personal data - noyb wins appeal against Spanish DPA The Spanish Courts annulled a past decision by the Spanish DPA (AEPD). The AEPD had previously argued that Virgin telco, a telecommunications provider, had lawfully denied its customers access to their location data. noyb argued that location data was personal data and must therefore be disclosed under the right to access.…
Cookie Banners A task force within the European Data Protection Board (EDPB) issued a draft report in reaction to noyb 's 700+ cookie banner complaints. The European Data Protection Authorities (DPAs) largely support noyb 's complaints. If implemented, this report could ensure minimum requirements for cookie banners. EDPB draft report on consent banners Worst Cookie Banners soon gone? Most users…
WhatsApp faces € 5.5 million fine, as DPC limits the scope of the case against WhatsApp and rejects the EDPB request to investigate matters like data sharing within Meta. As confirmed by the Irish DPC today, the European Data Protection Board (EDPB) has decided that Meta cannot force WhatsApp users to agree to the use of their data for "service improvements" and "security". The core matter of…
Forced Consent & Consent Bypass Irish Data Protection Authority gives € 3.97 billion present to Meta? Authority allegedly unable to take financial benefit from Meta's GDPR violations into account. On 04.01.2023, the Irish Data Protection Commission (DPC) announced a fine of € 390 million against Meta due to unlawful personalized advertising on Facebook and Instagram. A first analysis of the…
Forced Consent & Consent Bypass The Irish DPC issued its final decision on Meta's illegal processing of user data for personal advertising. Here is a download link and a first quick summary by noyb. The DPC decision clearly shows massive disagreement between the Irish DPC and the EDPB. Facebook Decision DPC Instagram Decision DPC Facebook Decision EDPB Instagram Decision EDPB Major fight between…
Forced Consent & Consent Bypass BREAKING: Meta (Facebook and Instagram) prohibited from using personal data for advertisement. Major blow to Meta's business model in Europe, following noyb litigation. Fine for Meta more than tenfold from € 28 million to € 390 million. Third case on WhatsApp pending. As confirmed by the Irish DPC, the European Data Protection Board (EDPB) has rejected the Irish…
Data Transfers Statement on US Adequacy Decision by the European Commission Today, the European Commission issued a new adequacy decision replacing the"Privacy Shield" decision, that was previously invalidated by the Court of Justice of the EU (CJEU) over US surveillance. The CJEU required (1) that US surveillance is proportionate within the meaning of Article 52 of the Charter of Fundamental…
Forced Consent & Consent Bypass noyb complaints: Meta's business model declared illegal in the EU according to WSJ. Facebook, Instagram and WhatsApp can no longer run personalized ads without user consent As reported by The Wall Street Journal, the EDPB has decided that Meta cannot force users to agree to personalized ads. In May 2018, when the GDPR came into force in the EU, Meta Ireland Ltd.…
Forced Consent & Consent Bypass GDPR Rights in Sweden: Court confirms that authority must investigate complaints. So far, the Swedish IMY has taken the view that users don’t have party rights in GDPR procedures. The Stockholm administrative court held that a complainant under Article 77 GDPR has the right to request a decision from the Swedish Data Protection Authority (IMY) after six months. So…
Cookie Banners Where did all the “reject” buttons come from?! More and more websites have added an option to say “no” to cookies and other tracking- as foreseen by the GDPR. Where did this trend come from? In March 2021, noyb scanned the web for illegal cookie banners and filed more than 700 complaints across Europe. A final scan shows a detailed assessment after 1.5 years: more than 50% of the…
Cookie Banners Two are better than one?! Profil.at strikes back with forced banner, when users make the "wrong" choice. Today, noyb.eu filed a GDPR complaint against the Austrian news magazine Profil. If you want to visit profil.at, you can reject all cookies in the first step. If one does so, however, a second banner pops up where one must agree to Google and other tracking cookies. Such forced…
Alarming: Court of Justice may severely limit enforcement of European’s privacy rights Hardly noticed by the general public, the Advocate General (AG) of the Court of Justice of the European Union (CJEU) has issued an opinion, aiming to limit one of the last potential avenues for users to enforce their privacy rights under the GDPR. According to the AG, Europeans would hardly get compensations…
Legal Analysis: No non-material damages for GDPR violations (C-300/21)? By Max Schrems | Download the PDF Version of this Legal Analysis On 6 October 2022, Advocate General (AG) Sánchez-Bordona issued his Opinion on CJEU case C-300/21 (UI v. Österreichische Post AG), the first of several preliminary ruling requests on the topic of damages for GDPR violations pending with the CJEU. Relevant…
Data Transfers We are now working on an in-depth analysis, which will be published on noyb.eu in the next days. First reaction: Executive Order on US Surveillance unlikely to satisfy EU law More than six months after an "agreement in principle" between the EU and the US, US President Joe Biden has signed the long-awaited Executive Order that is meant to respect the European Court of Justice's…
Data Transfers Half a year of political announcements, but no agreement on EU-US data transfers. On 25 March 2022, in the wake of the war on Ukraine, US-President Joe Biden and European Commission President Ursula von der Leyen announced an "agreement in principle" on EU-US data transfers, despite two Court of Justice (CJEU) rulings striking down the previous "Safe Harbor" and "Privacy Shield"…
Gmail creates “Spam Emails”, despite CJEU judgment Today, noyb.eu filed a complaint against Google with the French Data Protection Authority (CNIL). The tech giant has repeatedly ignored the European Court of Justice (CJEU) ruling on direct marketing emails and used its email platform Gmail to send unsolicited advertising emails without valid consent of the users. Complaint filed with French…
Cookie Banners Final round of “One Trust” cookie banners: 226 complaints lodged against deceptive cookie banners that are still not complying with GDPR requirements Today, noyb lodged 226 GDPR complaints with 18 authorities against websites that use the popular cookie banner software (“OneTrust”) with deceptive settings. Following a first batch of complaints in May 2021 many websites using…
Annual Report 2021 out now! Annual Report 2021 2021 marks noyb ’s fourth year of fig hting for the right to privacy. We have taken things up a notch by filing a record-breaking amount of complaints: noyb filed over 400 half-automated GDPR complaints on deceptive cookie banners. Hundreds of major websites have switched to a more reasonable cookie banner in the course of this project. Towards the…
€20 million fine for Clearview AI in Greece The Greek data protection authority has fined the company Clearview AI €20 million. The company that sells facial recognition software to law enforcement agencies in the U.S. is no longer allowed to process biometric data on individuals in Greece and must delete all existing data. Complaints in five countries. An alliance of organizations, including…
Data Transfers European DPAs get Facebook Data Transfer Decision by Irish DPC As the DPC informed journalists today, it issued a Draft Decision under Article 60 GDPR, concerning Facebook's (Meta's) EU-US data transfers in light of FISA 702 and the Snowden disclosures. The Draft Decision is part of the "own volition" procedure that the DPC initiated in parallel to the original complaint by Max…
Data Transfers UPDATE: Further EU DPA orders stop of Google Analytics The Italian DPA (GPDP) has joined the consensus shared by the EDPS, as well as the French and Austrian DPA and has banned the use of Google Analytics (GA). Following our 101 complaints on data transfers, the GPDP concluded that websites using GA collected user interactions and transferred user data to the US; a country without…
Forced Consent & Consent Bypass Sweden: Users are not party to their own privacy rights? The Swedish DPA (IMY) refuses to take a decision on a GDPR complaint, claiming that the user is not a party to his own rights. In essence, the IMY seems to take the view that the “right to a complaint” under Article 77 GDPR, which should give everyone free access to enforcement, is only a right to “petition”…
No right to access your own location data? noyb files appeal against Spanish DPA Today, noyb filed an appeal against a decision of the Spanish DPA (AEPD) regarding the phone provider Virgin Telco. A customer made an access request to receive his location data which was refused by Virgin Telco. The AEPD sided with the company and restricted the user’s access right under the GDPR, based on a…
Statement on 4 Years of GDPR GDPR did not change a culture of non-compliance. When the GDPR became applicable on 25 May 2018, it was perceived as a watershed moment. Comments were somewhere between the EU getting serious about privacy and the internet breaking down at midnight. The past four years have shown that a law alone does not change business models that are based on the abuse of personal…
Data Transfers Open Letter on the Future of EU-US Data Transfers While many details are still unclear, more and more details about the planned EU-US data transfer deal have emerged. These details seem to raise more questions as the the stability of any new adequacy agreement by the European Commission. In the light of these concerning developments, the lead plaintiff in the "Schrems I" and…
UPDATE on 101 complaints: Austrian DPA rejects “risk based approach” for data transfers to third countries After the groundbreaking decisions by the Austrian and French DPA that the use of Google Analytics is illegal, the Austrian DPA has now issued a second decision, going even further: It declared the use of Google’s IP anonymisation a useless protection measure for data transfers between the…
Political data breach in Malta: C-Planet refuses right to access and information Today, noyb filed a second complaint before the Information & Data Protection Commissioner (IDPC) against the Maltese IT company C-Planet. In January, the company received a €65 000 fine by the IDPC for illegal collection and leak of personal information including political preferences on nearly every Maltese voter.…
Forced Consent & Consent Bypass Irish DPC to pay tens of thousands in legal costs over 47 months delay in cases against WhatsApp and Instagram Today the Irish DPC has settled a case with noyb over a gross delay in two cases on Instagram and WhatsApp. 47 months after the filing of the cases on Facebook's "consent bypass", the DPC agreed to pay tens of thousands in costs for a Judicial Review over…
Data Transfers UPDATE: CNIL orders three controllers to comply with GDPR after decision that using Google Analytics is illegal Only weeks after the groundbreaking decision by the Austrian Data Protection Authority that the continuous use of Google Analytics violates the GDPR, the French Data Protection Authority (CNIL) ordered three French websites to comply with the GDPR. All these decisions…
Data Transfers "Privacy Shield 2.0"? - First Reaction by Max Schrems Today Commission President Ursula von der Leyen and President Biden have announced an "agreement in principle" on a new EU-US data sharing system. Factsheet by the European Commission Factsheet by the White House Some facts upfront: There is only a political announcement, not a text that can be analyzed. As far as noyb is…
Amazon Workers demand Data-Transparency In a cooperation between the worker’s union “UNI Global” and privacy NGO “noyb.eu”, Amazon warehouse workers from Germany, UK, Italy, Poland and Slovakia filed access requests under Article 15 GDPR today. The goal is to find out how Amazon treats workers’ personal data under the EU’s General Data Protection Regulation (GDPR). Workers are so far left in the…
€20 million fine for Clearview AI in Italy The Italian data protection authority has fined the company Clearview AI €20 million. The company that sells facial recognition software to law enforcement agencies in the U.S. is no longer allowed to process biometric data on individuals in Italy and must delete all existing data. Press Release by Italian DPA Complaints in five countries. An alliance…
Cookie Banners Many more Cookie Banners to go: Second Wave of Complaints underway This week, noyb launched the second round of its action against deceptive cookie banners, following a first batch in May 2021. Another 2 7 0 draft complaints were sent to website operators whose banners don’t comply with the GPDR. noyb offers guidelines for companies on how to comply and only file s formal GDPR…
giropay knows what you bought last summer Instead of only processing the payment, the German payment service "giropay" (formerly "paydirekt") keeps the information about each individual item purchased in online shops. This may lead to the processing of sensitive, personal data. A customer contacted noyb after see ing a detailed list of products she had ordered in an online pharmacy and a sex…
Data Protection Day: 41 Years of "Compliance on Paper"?! Today's Data Protection Day marks the signing of the first pan-European data protection framework (Convention 108) in 1981. Fast-forward 41 years later, the GDPR has become the main pillar of European data protection. Adopted in 2016 with high hopes, the GDPR is now on the verge of succumbing to a death similar to many data protection…
Data breach in Malta: 65.000 € fine for C-Planet Following a complaint by noyb, the Information & Data Protection Commissioner (IDPC) imposed a fine of 65 000 € on the IT company C-Planet. The company had illegally collected data of 98% of Maltese voters, including political preferences and failed to take appropriate data-protection measures. C-Planet notified neither the users nor the data…
Data Transfers Austrian DSB: Use of Google Analytics violates "Schrems II" decision by CJEU. In a groundbreaking decision, the Austrian Data Protection Authority ("Datenschutzbehörde" or "DSB") has decided on a model case by noyb that the continuous use of Google Analytics violates the GDPR. This is the first decision on the 101 model complaints filed by noyb in the wake of the so-called…
Cookie Banners EDPS sanctions the European Parliament for illegal EU-US data transfers - among other violations The European Data Protection Supervisor (EDPS) issued a decision after a complaint filed by noyb confirming that the European Parliament violated data protection law on its COVID testing website. The EDPS highlights that the use of Google Analytics and the payment provider Stripe (both…
GDPR complaint: Airbnb hosts at the mercy of algorithms Today, noyb.eu filed a GDPR complaint against Airbnb. The online market place for vacation rentals downgraded the complainant’s rating as a host, solely through automated decision making. While everyone has the right not to be subject to automated decision-making, Airbnb relies on exactly these practices. By denying the opportunity for the…
Help! My recruiter is an algorithm! noyb has filed a complaint with the Luxembourg data protection authority (the CNPD) against Amazon because of their dubious e-recruiting practices on their Mechanical Turk platform. In particular, Amazon uses automated decision-making to accept or reject workers - with no possibility for the applicants to understand the criteria behind such an automated…
Data Transfers Deep Dive: How to ignore the decisions of the CJEU in three steps. Facebook's Transfer Impact Assessment explained. For the privacy geeks, that want to know more than what we have summarized in our 4th Advent Reading, we provide a deeper dive on this page on the four elements of Facebook's "Transfer Impact Assessment" (TIA). Check our overview and summary in our 4th Advent Reading…
Data Transfers 4th Advent Reading: Facebook's "Transfer Impact Assessment" fully ignores rulings by Court of Justice In the last "Advent Reading" in protest against the Irish DPC's removal of noyb from a procedure, we will discuss Facebook's discarding of the European Court of Justice (CJEU) rulings on EU-US data transfers, in an allegedly "confidential" 86 pages "Transfer Impact Assessment".…
Identification & Authentication NCC & noyb GDPR complaint: "Grindr" fined € 6.3 Mio over illegal data sharing Today, the Norwegian Data Protection Authority imposed a fine of 65 Mio NOK (€ 6.34 Mio or $ 7.17 Mio) on Grindr. The LGBTQI dating app had not received valid consent from users, but had been sharing sensitive personal data nonetheless. Link to the decision by the Norwegian DPA (PDF)…
noyb 's third "Advent Reading": Facebook's laughable Record of Processing Activities (ROPA) In its third "Advent Reading" (in protest of the DPC unlawfully removing noyb from a pending procedure) noyb is publishing Facebook's main GDPR compliance document: Facebook's "Record of Processing Activities" under Article 30 GDPR (short: "ROPA"). Such legally required document should allow to easily…
ZDF Magazin Royale and noyb.eu ask for your data donation for democracy! Max Schrems in an interview in ZDF MAGAZIN ROYALE Link to the data donation page: targetleaks.noyb.eu Donate your Data! Max Schrems from noyb.eu was a guest of Jan Böhmermann and ZDF Magazin Royale with the goal of finding as many of 4,000 users as possible, who had installed the "Who Targets Me" browser extension during…
noyb 's Second "Advent Reading": How the Irish DPC tried to lobby Facebook's "GDPR bypass" into European Guidelines. This week, noyb published two rounds of documents as part of their "Advent Readings" from DPC and Facebook documents: A letter from Facebook to the Irish DPC confirms that the DPC had ten meetings with Facebook where they discussed and agreed on Facebook's GDPR bypass. The second…
Data Transfers noyb 's first "Advent Reading" from Facebook and DPC documents! Today we are glad to publish our first (still very improvised) advent reading from Facebook and DPC documents. This project is in protest of the DPC removing us from a procedure over alleged violations of confidentiality. To show that we are legally able to go much further than just publishing a (problematic) draft…
Irish DPC demanded noyb to sign a "non-disclosure agreement" or remove noyb from Facebook procedure. noyb files criminal report against DPC. The Irish Data Protection Commission (DPC) has taken the unheard-of move, to demand noyb to draft and sign a "non-disclosure agreement" (NDA) within one working day. In absence of such an NDA for the benefit of the DPC and Facebook, the DPC would not comply…
Data protection authority finds traffic and location data from cell phones not "personal" - noyb appeals to federal administrative court In June 2020, noyb had filed a formal complaint against the Austrian mobile provider A1. The reason: A1 had persistently refused to disclose location data and certain traffic data to a customer, citing the outdated ruling practice of the data protection…
Identification & Authentication Want your Grindr data? Show your ID and take a selfie! Today, noyb filed a GDPR complaint against Grindr – a dating app for gay, bi, trans and queer people, where many users share very personal and even explicit sexual details. Instead of authenticating against the data that users have provided, like the email and password – Grindr requires users to identify in…
"Black box" Amazon: algorithm discriminate customers noyb filed another complaint against Amazon Europe today. The e-commerce giant offers customers the possibility to pay for products later via "Monthly Invoice". A customer who was rejected for this payment method without any reasons given submitted an access request to Amazon in order to find out why he was rejected. The company refused to…
Credit Scoring Illegal credit scores: noyb to amplify pressure Today, noyb filed a complaint against the address trader Acxiom and the credit reference agency CRIF Bürgel in Germany. Their illegal trade with personal data of millions of Germans violates the GDPR as well as national data protection law. Data originally collected for direct marketing may not be used to calculate creditworthiness…
Forced Consent & Consent Bypass DPC sent "take down request" to noyb, after publishing a problematic Draft Decision stripping Facebook users of their rights under GDPR. Yesterday night, the Irish Data Protection Commission (DPC) sent an extraordinary letter (PDF) to noyb, saying it would " require [noyb] to remove the draft decision from your website forthwith, and to desist from any further or…
Forced Consent & Consent Bypass Irish DPC greenlights Facebook's "GDPR bypass". Schrems: “Decision undermines key element of GDPR.” Your browser does not support HTML5 videos. Click here to downlaod the video. The Irish Data Protection Commission (DPC) has sent a "draft decision" (PDF) to the other European Data Protection Authorities on Facebook's legal trick to bypass the GDPR. noyb has…
Irish DPC issued € 225 million fine against WhatsApp/Facebook Press Release by Irish DPC EDPB Decision (redacted) More Information in First Media Reports Statement by Max Schrems, Chair of noyb.eu Mr Schrems and noyb, as a non-profit organisation, both have a number of pending cases before the DPC (including on WhatsApp) and have been monitoring the situation at the Irish DPC closely since 2011.…
In internal news: noyb is hiring lawyers and developers! Not only our workload, but also our team is growing bit by bit. We are happy to announce that we now looking for GDPR lawyers and full stack developers to join our team. You can find more details on our job page. As finding the right match for these positions is not always easy, we would be more than happy if you could also spread the news…
Cookie Banners News Sites: Readers need to "buy back" their own data at an exorbitant price Today, noyb filed complaints against the cookie paywalls of seven major German and Austrian news websites: SPIEGEL.de, Zeit.de, heise.de, FAZ.net, derStandard.at, krone.at and t-online.de. An increasing amount of websites asks their users to either agree to data being passed on to hundreds of tracking…
Cookie Banners noyb files 422 formal GDPR complaints on nerve-wrecking “Cookie Banners” As part of a one-year project on "deceptive designs" and "dark patterns", noyb aims to scan, warn and enforce the GDPR on up to 10.000 websites in Europe. After sending a written warning and a “draft complaint” to more than 500 companies on May 31st, 42% of all violations were remedied within 30 days.…
Credit Scoring Data voodoo: Credit ranking agency CRIF creates creditworthiness out of thin air. Data protection authority also demands disclosure of "scoring" logic. After about a year, the Austrian Data Protection Authority (DPA) finally issued a decision on our first complaint against the credit reporting agency CRIF. CRIF had attributed a negative credit rating to a data subject although the…
BREAKING: Austrian Supreme Court asks CJEU if Facebook "undermines" the GDPR by confusing 'consent' with an alleged 'contract'. In a long-standing civil case between Max Schrems and Facebook, the Austrian Supreme Court (Oberster Gerichtshof, or "OGH") has accepted Mr Schrems' request to refer a number of questions to the Court of Justice of the European Union (CJEU, the highest Court in the EU).…
Forced Consent & Consent Bypass In January 2019 we filed complaints against eight streaming services for not responding properly to simple access requests. As one of the most basic rights under the GDPR, the right to access allows users to find out what data a company has on them and how it is being used. Exactly two and a half years after we first filed the complaints, the lack of GDPR…
Data Transfers Statement by Max Schrems a year after the "Schrems II" decision by the Court of Justice of the European Union A year ago the so-called "Schrems II" decison was referred to as ground breaking, despite it being the second time that the CJEU has declared EU-US data transfers unlawful - based on EU law that has effectively existed since 1995. Over the last year, it seems that the…
Our third year of fighting for privacy: Annual Report 2020 out now Annual Report 2020 (EN) After successfully setting up our team, office and processes in the past years, 2020 marks the year in which we could truly focus on our legal work and enforcement strategy. Our team in Vienna grew to 15 people from 10 countries by the end of the year and was responsible for more than 125 complaints and…
Cookie Banners New browser signal could make cookie banners obsolete Today, noyb and Sustainable Computig Lab ("CSL") published a proposal for a new automatic browser signal to finally eliminate obsolete cookie banners. "Advanced Data Protection Control" (ADPC) aims to demonstrate that a user-friendly European solution for privacy settings can easily be implemented. More information can be found…
Cookie Banners noyb aims to end “cookie banner terror” and issues more than 50 0 GDPR complaints Today, noyb.eu sent over 500 draft complaints to companies who use unlawful cookie banners - making it the largest wave of complaints since the GDPR came into force. By law, users must be given a clear yes/no option. As most banners do not comply with the requirements of the GDPR, noyb developed a…
Digital Rights alliance file legal complaints across Europe against facial recognition company Clearview AI Today, noyb and other EU digital rights organisations filed legal complaints to stop online mass surveillance by facial recognition company Clearview. Complaint filed to Austrian Data Protection Authority (PDF) Blogpost Privacy International Complaints in five countries. A coalition of…
Statement: 3rd Anniversary of the GDPR Three years ago, on 25 May 2018, the General Data Protection Regulation became applicable. The GDPR was meant to give rights to everyday people that are subject to data processing (“data subjects”). At noyb, we apply the GDPR from that user perspective every day. After three years, our first interim conclusion is mixed: The GDPR has clearly brought the…
The European Parliament has adopted a resolution ( Link) calling on the European Commission to start infringement procedures against Ireland, over the lack of GDPR enforcement. Today the votes became public: The resolution was adopted by a vast majority of 541 votes, with only one vote by an independent Member against the resolution ( Link). 151 members abstained from the vote. The resolution…
Data Transfers Decision by Irish High Court: DPC must now implement CJEU judgment and stop Facebook's EU-US data transfers. The High Court ruled today, that the Irish Data Protection Commission (DPC) had the right to open a second "own volition" investigation against Facebook. Facebook's attempt to stop this second investigation failed. The judge held: "I refuse all of the reliefs sought by…
Data Transfers Google continues to send data from EU websites to the US - despite two Court of Justice rulings. Austrian Data Protection Authority could fine Google up to €6 billion. Last summer, the European Court of Justice (CJEU) ruled - already for the second time - that US surveillance laws generally make the transfer of personal data from the EU to the US illegal. Google continues to…
Irish DPC openly acknowledges: It does not decide about GDPR complaints. At least 99.93% see no decision, despite €19.1 million funding. In a rather astonishing hearing before the Joint Committee on Justice of the Irish Parliament, the Irish Data Protection Commissioner (DPC), Helen Dixon, acknowledged for the first time publicly what many suspected: The Irish Regulator does not decide on…
Online & Mobile tracking Buy a phone, get a tracker: unauthorized tracking code illegally installed on Android phones As reported by the Financial Times, noyb launched further action against Google’s AAID (Android Advertising Identifier), following similar complaints against Apple’s IDFA. The somewhat hidden ID allows Google and all apps on the phone to track a user and combine information about…
Credit Scoring Illegal data exchange between address publisher and credit ranking agency noyb filed a GDPR complaint against the credit ranking agency CRIF GmbH and the address publisher AZ Direct on March 18, 2021. The companies exchange data which violates the GDPR, as well as Austrian law. Address publishers are only allowed to pass on data for advertising purposes, but not to credit agencies…
Data Transfers EU-US Transfers, a Parliamentary Resolution — and a Dramatic Exit. As the Irish Times and the Financial Times reported yesterday evening, a substantial fight between the Irish DPC, the German BfDI and the European Parliament's LIBE Committee has emerged over the DPC's failure to enforce the GDPR on Big Tech. After Helen Dixon (Irish DPC) called into question other DPAs and the…
Facebook's GDPR consent bypass via a "contractual advertisement duty" before Austrian Supreme Court, with high potential for a reference to the CJEU As the Austrian Press Agency (APA) and Der Standard report, a case that may determine the legality of Facebook's business in Europe has reached the Austrian Supreme Court (OGH). Facebook and Mr Schrems have both filed appeals against an earlier…
Credit Scoring Right of access as a data protection boomerang? Credit reference agency collects data from people who request information On 08.02.2021, noyb filed a GDPR complaint against the credit worthiness data broker KSV 1870. The Austrian credit reference agency stores data from previously unknown individuals who exercise their legal right to access their data without permission. Download:…
Clearview AI’s biometric photo database deemed illegal in the EU, but only partial deletion ordered Clearview AI is a US company that scrapes photos from websites to create a permanent searchable database of biometric profiles. US authorities use the face recognition database to find further information on otherwhise unknown persons in pictures and videos. Following legal submissions by noyb,…
Statement on European Data Protection Day This years European Data Protection Day on January 28th, marks the 40th anniversary of the signing of the European Data Protection Convention (Convention 108) on January 28th 1981. This international treaty set rules for the automated processing of personal data and data transfers for the first time and is still the foundation for current European data…
Identification & Authentication "Grindr" to be fined almost € 10 Mio over GDPR complaint. The Gay Dating App was illegally sharing sensitive data of millions of users. In January 2020, the Norwegian Consumer Council and the European privacy NGO noyb.eu filed three strategic complaints against Grindr and several adtech companies over illegal sharing of users’ data. Like many other apps, Grindr…
GDPR: A Law without Authority? Luxemburg’s Data Protection watchdog refuses to show its teeth to US companies. noyb files court case Today, noyb filed an appeal against two decisions of the Luxemburg Data Protection Authority (CNPD) before the administrative tribunal of Luxemburg on a fundamental matter: the authority dismissed two complaints lodged against US-based data controllers, Apollo and…
Data transfers to the US and insufficient cookie information: noyb filed complaint on behalf of six MEPs against the European Parliament. Today, noyb filed a complaint against the European Parliament on behalf of six MEPs. The main issues raised are the deceptive cookie banners of an internal corona testing website, the vague and unclear data protection notice, and the illegal transfer of data…
Data Transfers Irish DPC settles Judicial Review and agrees to decide swiftly. Blocked procedure on Facebook's EU-US data flows can continue. The DPC has agreed with Max Schrems' demand to swiftly end a 7.5 year battle over EU-US data transfers by Facebook and come to a decision on Facebook's EU-US data flows. This only came after a Judicial Review against the DPC was filed by Mr Schrems. The…
The Viennese Superior Court (Oberlandesgericht Wien) has delivered a ruling today that Facebook must pay Mr Schrems € 500 in emotional damages and grant him full access to all the data that Facebook holds about him. However, the internet giant does not need to get consent from users to use their data under the EU data protection law (Article 6(1)(a) GDPR). Instead Facebook can simply grant…
Data Transfers “ Schrems II ” reaches US Legislator: US Senate Hearing on EU-US data transfers today Today at 10:00am EST / 16:00 CET the Committee for Commerce, Science and Transportation of the United States Senate will have a hearing on the EU-US data transfers after the Schrems II decision. Max Schrems, honorary chairman of noyb and plaintiff in the underlying case before the CJEU C‑311/18 -…
Online & Mobile tracking noyb files complaints against Apple's tracking code "IDFA" IDFA (Apple’s Identifier for Advertisers) allows Apple and all apps on the phone to track a user and combine information about online and mobile behaviour. Just like for cookies, this would require the users’ consent under EU law. Apple places these tracking codes without the knowledge or agreement of the users.…
Data breach in Malta: complaint against C-Planet filed noyb has filed a complaint against C-Planet IT Solutions, the company responsible for the leaked database of voter’s data in Malta. In parallel, the NGOs Daphne Foundation and Repubblika initiated a class action for those affected. Download: Complaint filed to the Maltese Data Protection Authority An unbelievable data leak. News of a massive…
Your browser does not support the video tag. This week we reached the first 3,000 subscribers for our GDPR expert newsletter: GDPRtoday! Within only 10 months our project GDPRhub and the regular newsletter GDPRtoday has reached exceptional popularity. By now, more than 3,000 GDPR experts follow our weekly newsletter that contains English summaries of GDPR decisions from all over Europe. Together…
In September, the Belgian Official Journal published a Ministerial Decree approving noyb as a qualified entity under the collective action scheme of the Belgian Code of Economic Law. This means that noyb can file representative actions in Belgium and claim damages on behalf of users of a company for the violation of various laws relating to consumer protection, including data protection…
Data Transfers DPC ordered to pick up most of the legal bill of EU-US data transfer case Today, the Irish High Court has ordered the DPC to cover the costs of Mr Schrems’ legal team in relation to this summer’s decision on EU-US data transfers before the Court of Justice of the European Union (CJEU). The DPC is not entitled to their costs from Facebook, except the cost for three court days will…
Data Subject Rights Wizz Air: €1 for a flight, €35 for your GDPR right On 21.10.2020 noyb filed a GDPR complaint against Central and Eastern Europe’s Largest Low Cost Airline, Wizz Air. A passenger changed her surname. Despite the free right to rectification under the GDPR, the airline charged € 35 in phone charges to update a surname. The relevant email was never updated, leading to emails by…
On Tuesday, noyb filed a GDPR complaint against the Vienna-based address broker AZ Direct Österreich GmbH. The company, which belongs to the Bertelsmann group, had refused to provide information on the origin and recipients of the data processed. The reasons given were shocking: The address broker claims not to know where the data came from – i t would have been too burdensome to record that.…
Data Transfers Irish High Court allows Judicial Review aiming to stop Facebook’s EU-US Data Transfers The Irish High Court has granted leave for a “Judicial Review” against the Irish Data Protection Commission (DPC) today. The legal action by noyb aims to swiftly implement the European Court of Justice Decision prohibiting Facebook’s EU-US data. 7 Years and 5 Judgments, but no DPC decision. In…
Data Transfers Opening Pandora’s Box: Companies can't say how they comply with CJEU ruling Following the Court’s judgment in Case-C-311/18 (“Schrems II”) on the Privacy Shield and Standard Contractual Clauses, the noyb team and some of our members reached out to 33 companies and services that they use on a personal basis to ask them how they were approaching international data transfers. The…
Data Transfers Just over a month ago, noyb filed 101 complaints against several companies based in the EU/EEA because they continue to use Google Analytics and Facebook Connect on their websites – thereby transferring personal data to Google and Facebook in the US. According to the CJEU judgement of 16 July 2020, such data transfers are illegal because Google and Facebook are subject to US…
Forced Consent & Consent Bypass First decision on noyb’s streaming complaints - after more than one and a half years In cooperation with the Austrian Chamber of Labour, noyb filed eight complaints against streaming services such as Netflix and Amazon Prime in January 2019 for not sufficiently complying with the right of access under Article 15 GDPR. A first decision has now been issued: At the…
Data Transfers Today at about 15:00 BST (16:00 CET) the Irish High Court has granted Facebook leave to file a Judicial Review against the DPC (Case No 2020/617 JR) and stayed a new "ex officio" procedure by the DPC into EU-US data flows. For now Facebook has succeeded in stopping the DPC's investigation into EU-US data flows, that are not legal under an instrument called "Standard Contractual…
Data Transfers Is the DPC actually stopping Facebook's EU-US data transfers?!..maybe half-way! The WSJ reported on Wednesday night that the Irish Data Protection Commission ("DPC") has allegedly issued a "preliminary order" for Facebook to stop EU-US data transfers. Earlier this week, we informed the DPC that we plan to file an interlocutory injunction over their decision to instigate a "second"…
Annual Report for 2018 and 2019 noyb has started at the turn of 2017 to 2018 with a bold vision: to establish a European non-profit that works on strategic litigation to ensure that the GDPR is upheld. We started with a concept, a website and a crowdfunding tool. Within two months we managed to get thousands of "supporters" that allowed us to start with basic funding at €250.000 per year. For…
Data Transfers Watch the full length video here: On September 3rd, our honorary chairman, Max Schrems, participated in a hearing of the European Parliament to discuss the judgment of EU-US data transfers which invalidated Privacy Shield and defined the validity of standard contractual clauses. Together with EU Commissioner for Justice, Didier Reynders and Head of the EDPB, Andrea Jelinek, they…
Data Transfers A quick analysis of the HTML source code of major EU webpages shows that many companies still use Google Analytics or Facebook Connect one month after a major judgment by the Court of Justice of the European Union (CJEU) - despite both companies clearly falling under US surveillance laws, such as FISA 702. Neither Facebook nor Google seem to have a legal basis for the data…
Credit Scoring noyb.eu filed a GDPR complaint against the credit rating agency "CRIF", who is active in over 28 countries. CRIF assigned a "score" of exactly 446 out of 700 possible credit points to a debt-free electricity customer with a well-paid permanent job. This is astonishing as CRIF emphasised several times that it did not know the person concerned and did not have any data stored on…
Data Transfers Following the CJEU's judgment on EU-US data transfers by Facebook, we requested that the Irish DPC take action. The DPC's first response indicates that it is unwilling to commit to a clear time frame to reach a decision, despite it having been seven years and five court rulings since our original complaint was filed. Exchange of letters with the Irish DPC (PDF) In 2015 following…
Data Transfers On this page we have summarized the options for users that want to stop their data being transferred to the United States after the CJEU judgment in C-311/18 ("Schrems II") on the Privacy Shield and Standard Contractual Clauses ("SCCs"). In addition we added a couple of FAQs that may help you identify cases where you have a right to request a stop to data transfers. What can I do…
Your browser does not support the video tag. We are fully aware that many controllers are overwhelmed with the recent judgment by the CJEU on EU-US data transfers and the lack of a grace period. We have summarized the most common questions and answers below. We also provide two model request texts that you can send to any US partner or any EU partner with US ties. Taking swift action may be a…
Data Transfers CJEU invalidates “Privacy Shield” in US Surveillance case. SCCs cannot be used by Facebook and similar companies. Facebook and similar companies may also not use "SCCs" to transfer data as DPC must stop transfers under this instrument. Schrems: “We need US surveillance reform. The Court has clarified that there cannot be any transfer of data in violation of EU law.” Max Schrems’…
The CJEU received eleven questions submitted by the Irish High Court. The CJEU was free to reformulate the questions and address only some of them. This FAQ gives a simple overview of the judgment and the questions answered. It addresses the most relevant questions that people and companies may have about the CJEU’s judgment. (I) Scope of the case Which EU-US data transfers are not affected by…
Forced Consent & Consent Bypass In the complaints procedures concerning WhatsApp and Instagram, both based in Ireland, the Irish Data Protection Commission (DPC) has taken 2 years only to produce a first "Draft Inquiry Report". This is only the first of six steps in an urgent GDPR case before arriving at an actual decision. After multiple exchanges with the DPC, noyb.eu was granted leave by the…
A judge of the Vienna Regional Court delivered a written judgment ( PDF, German) in a long-lasting civil case on Facebook yesterday night. Despite summarizing detailed facts about Facebook's illegal data use, no real analysis or decision on the legal arguments was undertaken. Within the 39 page "judgment" there are only 19 short sentences on Data Protection Law. The judge apparently wanted to…
In May, we published an open letter describing the Irish DPA’s (DPC) “Kafkaesque” procedure for its handling of the Facebook case. The Facebook Group could face a fine of up to € 2.5 billion if the DPC follows the findings in its internal investigator report. While we have not received any answer from the European Commission or the European Parliament on the matter, the European Data Protection…
Forced Consent & Consent Bypass Background. Following a complaint by noyb and a similar complaint by the French NGO “La Quadrature du Net” the CNIL (the French Data Protection Authority) imposed a 50 million euro fine on Google over the company’s opaque privacy policy and lack of legal basis for personalized ads. This is so far the highest fine adopted by a DPA as a final decision. Nevertheless…
noyb.eu filed a GDPR complaint against A1 Telekom Austria on Friday, as A1 refuses to provide traffic and location data to its customers. Since A1 also uses this data for movement analyses (recently for corona analyses), the lack of transparency seems particularly problematic. Download: Complaint German (PDF) Location data. Part of the complaint deals with "location data". This is data…
After a massive leak of the voter ’s list showing the voting preferences, addresses, phone numbers and dates of birth of a majority of the Maltese population, noyb.eu will assist the Daphne Foundation and Repubblika in their class action and file complaints about the data breach in various EU Member States. Massive privacy violations of voters’ data. At the end of March 2020, independent Maltese…
Within hours of the new GDPR being applicable on 25 May 2018, the European non-profit organisation noyb.eu filed three complaints against the Facebook Group (including WhatsApp and Instagram). Since then, the Irish Data Protection Commission (DPC) has declared the contents of the extremely slow procedure “ confidential ” and asked noyb.eu not to discuss them in public. Despite this alleged (and…
A fter lack of reaction: former Apple employee presents letter to DPAs, asking them to investigate Siri recording the users. noyb.eu will be looking into the case. We generally believe that Siri only listens to us when triggered by the well-known command " Hey Siri! ". In such cases, users are conscious of sharing their personal data – be it a search (“ Hey Siri, show me the nearest restaurant…
Online & Mobile tracking T oday noyb.eu filed a formal GDPR complaint against Google for tracking users through an “Android Advertising ID” without a valid legal basis. The data collected with this unique tracking ID is passed on to countless third parties in the advertising ecosystem. The user has no real control over it: Google does not allow to delete an ID, just to create a new one.…
Austria: First European "corona app" with 400,000 active users reviewed by noyb, epicenter.works and SBA resarch. Privacy friendly concept, that can still be improved. Download the English translation of the report (PDF) here Download the German original Report (PDF) here Download the press release (PDF, English) here Here you can find the video of the German media call (YouTube) Here you can…
In recent days, the discussions around the use of data to combat the corona pandemic have increased. Therefore, we have written an ad hoc paper v0.3 (PDF, English) on compliance with the GDPR and would like to take this opportunity to provide an initial overview of these projects. Overview of various measures and projects There is a lot of talk about various corona measures and projects that are…
The outbreak of the SARS-CoV-2 pandemic has forced many people to work from home. Video conferencing tools and other remote means of communication make this possible, transforming our homes into our offices. They also help keep us connected with friends and family, regardless of where they are. Video conferencing tools literally open a lens into our homes. The personal and professional spheres…
Forced Consent & Consent Bypass Cinemas and theatres are closed but the show must go on, as they say. And the show does go on. There is TV, of course, but also streaming services such as Netflix or Amazon. Streaming services are slick and fun … and generate a lot of data about which movies or songs you consume when and where. However, they often sloppily explain to users what happens to their…
Data Security Baseline email security missing. During their route to the recipient, emails are handled by different entities, nodes and service providers which may intercept, manipulate and unlawfully use the content. In order to reduce these risks, it is a baseline industry standard to use so-called TLS encryption. View complaint (PDF) “ TLS is like an envelope around a letter. If not used,…
The content on GDPRhub is divided into two databases: decisions and knowledge. In the decisions section we collect summaries of decisions by national DPAs and courts in English. The summaries can be searched by relevant GDPR article, the issuing DPA or the deciding court. Every day we monitor more than 50 webpages in each Member State. This page currently contains 100+ decisions and the goal is…
After more than 9 hours, the Vienna Regional Court for Civil Matters (LGfZRS) closed the oral hearing in the data protection case against Facebook. The judgement will be issued in writing within the next months. The witness of Facebook (Cecilia Alvarez) emphasized repeatedly that data protection on Facebook would be easy to understand – just to say that she did not understand what the platform…
Identification & Authentication Link to the main page of the Norwegian Consumer Council: https://www.forbrukerradet.no/out-of-control/ Research by the Norwegian Consumer Council ( Forbrukerrådet) shows that many smartphone apps send highly personal data to thousands of advertising partners. The report uncovers how a large number of shadowy entities are receiving personal data about our…
Data Transfers Data Protection Authorities must stop data transfers if Fundamental Rights are violated. Serious doubts over Privacy Shield. Advocate General applies ECHR instead of CFR. Schrems: “The opinion follows almost all of our arguments” Download the First Statement here (PDF) Download the Background Document here (PDF) Max Schrems’ (chair of noyb.eu and party to the case) first reaction…
Data Transfers In preparation of the delivery of the non-binding advisory opinion of the Advocate General on December 19th at about 9:45 in Luxemburg, we have compiled the following preparation document. The case is pending for 6.5 years, deals with complex EU privacy and US surveillance laws and was subject to four hearings before different courts. It is therefore highly complex. Download the…
Cookie Banners Cookie banners of large French webpages turn a clear “NO” into “fake consent” noyb.eu files three GDPR complaints with the French Data Protection Regulator (CNIL). Quick Links: Press Release ( PDF, English) Copy of complaints: CDiscount ( PDF, EN), Allocine.fr ( PDF) and Vanity Fair ( PDF) Relying on the open source extension “Cookie Glasses” developed by researchers of the French…
The world’s largest social network believes it has found a way to bypass Europe’s strict privacy laws. In yesterday’s proceedings before the Vienna Regional Court ( Landesgericht für Zivilrechtssachen), Facebook openly admitted that it has been collecting and processing data without users’ consent since the introduction of the GDPR on May 25, 2018. Download PDF According to the GDPR, in addition…
Download: Press Release Due to a number of requests, we have summarized the key facts of the case before the Court of Justice of the European Union (CJEU) on EU-US data transfers and mass surveillance by the US government. The case will be heard tomorrow (9:00, Tuesday, July 9th) before the Grand Chamber of the Court of Justice. Common misunderstandings of the case Is this case about all EU-US…
Key Info The French data protection authority (CNIL) just has announced that it has imposed a record fine of € 50 million on Google for violating the GDPR today ( Link) The penalty is based on two complaints by noyb.eu and the French NGO ‘La Quadrature du Net’ based on ‘forced consent’ on May 25, 2018 ( More Information on the original complaints) Fine of € 50 million is the highest fine for…
The Austrian Supreme Court has ultimately rejected all attempts by Facebook to block a model lawsuit on fundamental privacy issues in Vienna now. In the final decision ( link), the Austrian Supreme Court rejects all attempts by Facebook to block the procedure. Download Press Release PDF Before doing so, Facebook tried to raise questions whether it is possible to bring GDPR rights before the…
noyb and Access Now jointly hosted the workshop “One year after GDPR: Advancing rights through effective enforcement actions” from May 8 to 10 in Vienna. The workshop aimed to share best practices on how to detect data protection violations and how to strategically lodge complaints with the various data protection authorities. Among the attendees were representatives from public authorities,…
In the ongoing procedure on Facebook’s involvement with the NSA under the so-called “PRISM” surveillance program before the Irish Data Protection Commission (DPC) and the Irish High Court, the Irish Supreme Court has today decided over an unprecedented application by Facebook. Facebook’s application was denied in substance. While the Supreme Court found that it has the jurisdiction to intervene…
Data Subject Rights Quick Links: Complaint Amazon Complaint AppleMusic Complaint DAZN Complaint Flimmit Complaint Netflix Complaint SoundCloud Complaint Spotify Complaint YouTube Right to Access. Under the new General Data Protection Regulation (“GDPR”), users enjoy a “right to access”. Users are granted a right to get a copy of all raw data that a company holds about the user, as well as…
Guest commentary by Max Schrems in ‘Der Standard’ (an Austrian newspaper) to the subscription type ‘PUR-Abo’ by DerStandard.at ‘Would you like to have a bit more privacy? – Then you have to pay € 6 per month’ From Vienna to Berlin to Brussels, many experts and lawyers responded with disbelief to a decision of the Data Protection Authority (DSB) this week. ‘,Pay, or give up basic rights’ is not…
Many controllers reacted to GDPR with automated systems. While this may be effective and helpful in many cases, there is a tendency that controllers limit the options of data subjects to express their rights to certain „requests“ – that may not always be in the interest of the data subject. Many forms of automated requests are also extremely complicated or not useable in practice.
On November 11th, 2018 our director Max Schrems was on 60Minutes (the Sunday night TV program on CBS), trying to explain the good and the bad of GDPR and how we try to enforce it in practice! Link: https://www.cbsnews.com/video/gdpr-the-law-that-lets-europeans-take-back-their-data-from-big-tech-companies-60-minutes/
noyb represents a customer of an Austrian bank, who wanted access to his bank account details – but was denied access. The Austrian DPA has decided in favor of the customer, but the bank appealed to the Federal Administrative Court (BVwG). In essence the bank argued, that the (free) right to access under GDPR is overridden by banking regulations that allow banks to charge extra fees for any…
Forced Consent & Consent Bypass Privacy à la “take it or leave it”? The new General Data Protection Regulation (GDPR) which came into force today at midnight is supposed to give users a free choice, whether they agree to data usage or not. The opposite feeling spread on the screens of many users: tons of “consent boxes” popped up online or in applications, often combined with a threat that the…
| OK | European Data Protection Board | 10 items |
| FAIL | European Data Protection Supervisor | HTTPError: 403 Client Error: Forbidden for url: https://www.edps.europa.eu/feed/news_en |
| FAIL | European Parliament – Press releases | HTTPError: 403 Client Error: Forbidden for url: https://www.europarl.europa.eu/rss/doc/press-releases/en.xml |
| OK | noyb – European Center for Digital Rights | 294 items |