Overview of noyb's GDPR complaints with DPAs

Case Lodged CSA LSA Company Status Duration Summary More info
C001 25/5/2018 France Ireland Google Partly Decided 1344 The complaint is one of four complaints on "forced consent" (see C001 to C004). The issue is that the user is forced to consent to the processing of their personal data to use the service. Therefore, such consent cannot be considered as free which is a condition for its validity.

After a complaint filed on 25 May 2018, the French DPA (CNIL) adopted a decision in January 2019, fining Google € 50 million.

The CNIL then sent the case to the Irish DPA (DPC) for the remaining elements, as Google claimed its main establishment in Europe to be in Ireland. On 25 January 2022, the CNIL informed noyb that the case was sent back to the CNIL by the DPC, that considers that Google LLC is the controller for this case. The CNIL informed us that it will ask the EDPB to adopt a decision under Article 65(1)(b) GDPR.
https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook
C002 25/5/2018 Austria Ireland Facebook Not Decided 1344 The complaint is one of four complaints on "forced consent" (see C001).

After the complaint was filed in Austria, it was sent to the Irish DPA (DPC) as the lead supervisory authority.

The DPC stated the case would be treated as a "pathfinder" for the other three pending "forced consent" cases.

Soon after, a "six step procedure" was started. A draft investigator report, a final investigator report, a preliminary draft decision and a final draft decision were delivered - each about 100 pages long. While the reports are repetative, the overall time taken to issue these reports was about 3.5 years. Nevertheless, the Irish DPA has not provided all documents to noyb and has therefore not allowed for a fair hearing. Allegations of "confidential" meetings between the DPC and Facebook have further added to the highly problematic procedure that may be overturned.

The final "draft decision" of the DPC was rejected by other European data protection authorities under Article 60(4) GDPR. This was not surprising, as the Irish DPA openly refused to accept the legal view of the other DPAs that was expressed in an EDPB guideline in 2020. The DPC is now reconsidering the draft decision, but has removed noyb from the procedure over alleged "confidentialty" of documents.

There is no active co-decisionmaking between the two authorities. The Austrian DPA (DSB) acts as a translator in the case and performs machine translations and forwards documents. The Austrian DPA has tried to get relevant documents from the DPC, but had troubles to ensure full disclosure of all the documents filed by the DPC. The DSB also started an open fight with the DPC over the scope of the procedure, which the DPC tried to limit.
https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook
C003 25/5/2018 Belgium Ireland Instagram (Facebook) Not Decided 1344 The complaint is one of four complaints on "forced consent" (see C001).

It was filed in Belgium and forwarded to the Irish DPA (Irish DPA) as the lead supervisory authority.

Soon after, a "six step procedure" was started. A draft investigator report, a final investigator report, a preliminary draft decision and a - each about 100 pages long. While the reports are repetative, the overall time taken to issue these reports was about 3.5 years. Nevertheless, the Irish DPA has not provided all documents to noyb and has therefore not allowed for a fair hearing. Allegations of "confidential" meetings between the Irish DPA and Facebook have further added to the highly problematic procedure that may be overturned. Despite the other DPAs rejecting the legal views of the Irish DPA in the "pathfinder" case on Facebook (see above) the Irish DPA has nevertheless just copy/pasted the decision, with no prospects of being able to win a majority among the DPAs.

There is no active co-decisionmaking between the two authorities. While the Belgian DPA (APD) seemed to act as a mere mailbox in the beginning, they now asked the Irish DPA to decide on which national procedure should be applicable. Since the complaint was filed in Belgium, an oral hearing should be held and documents and procedures should be in French.
https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook
C004 25/5/2018 Germany (BfDI) Ireland WhatsApp (Facebook) Not Decided 1344 The complaint is one of four complaints on "forced consent".

It was filed in Hamburg and forwarded to the Federal German DPA (BfDI) and then Irish DPA (DPC) as the lead supervisory authority.

Soon after, a "six step procedure" was started. A draft investigator report, a final investigator report, a preliminary draft decision and a final draft decision were delivered - each about 100 pages long. While the reports are repetative, the overall time taken to issue these reports was about 3.5 years. Nevertheless, the DPC has not provided all documents to noyb and has therefore not allowed for a fair hearing. Allegations of "confidential" meetings between the DPC and Facebook have further added to the highly problematic procedure that may be overturned. Despite the other DPAs rejecting the legal views of the DPC in the "pathfinder" case on Facebook (see above), the DPC has neverthless just copy/pasted the decision, with no prospects of being able to win a majority among DPAs.

There is no active co-decisionmaking between the two authorities, as the BfDI seems to mainly translate and forwards documents. The BfDI has tried to get relevant documents from the DPC, but had troubles to ensure full disclosure of all filed documents by the DPC.
https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook
C005 3/12/2018 n/a France Criteo Not Decided 1152 This case concerns the freedom to choose any form (like email or letters) to exercise GDPR rights, while companies often require to use very complicated online forms, plugins or other obscure methods.

This case is with the French DPA (CNIL). We were told that due to high workloads and the need to cooperate with other DPAs (Germany, Belgium, Sweden, Norway, Spain, Denmark, Italy, Poland, Cyprus, Slovenia, Austria, Portugal) this case moved very slowly.
https://noyb.eu/en/test-cases-freedom-exercise-gdpr-rights-any-format
C006 11/12/2018 Austria Ireland Google Not Decided 1144 This case concerns the freedom to choose any form (like email or letters) to exercise GDPR rights, while companies often require very complicated online forms, plugins or other obscure methods.

This case is on opting out of Google's data processing. The case was filed in Austria and is stalled due to unclear responsibilities, as Google claims that the Irish DPA (DPC) is the lead supervisory authority.
https://noyb.eu/en/test-cases-freedom-exercise-gdpr-rights-any-format
C007 18/1/2019 Austria Netherlands Netflix Not Decided 1106 This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request).

This case seems to be lost beween Austria and the Netherlands. Is is unclear which cases were recorded in the Netherlands and if any steps by the Dutch DPA were taken by now. In October 2021, noyb repeated its request with the Austrian DPA (already made in March and June 2021), to approach the Dutch DPA (lead supervisory authority) to clarify:
1) if the Dutch DPA is handling both cases (C007 and C008) or only one of them (the Dutch DPA only assigned one case number but never mentioned a complainant)
2) if the complainants are even considered as parties to the procedure(s)
3) if the parties can have access to the Dutch DPA's investigative report, which is informally circulated within the EDPB.

Both the Austrian and the Dutch DPA are ignoring these requests, leaving noyb in the blue. It seems possible that one of the complaints has been lost between the Austrian DPA and the Dutch DPA.

While Austrian administrative law requires a decision within 6 months, there is an excemption for the time another EU authority needs outside of Austria. This leads to an unlimited time for a decision.
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access
C008 18/1/2019 Austria Netherlands Netflix Not Decided 1106 This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request)

This case seems to be lost beween Austria and the Netherlands. Is is unclear which cases were recorded in the Netherlands and if any steps by the Dutch DPA were taken by now. In October 2021, noyb repeated its request with the Austrian DPA already made in March and June 2021, to approach the Dutch DPA (lead supervisory authority) to clarify:
1) if the Dutch DPA is handling both cases (C007 and C008) or only one of them (the Dutch DPA only assigned one case number but never mentioned a complainant)
2) if the complainants are even considered as parties to the procedure(s)
3) if the parties can have access to the Dutch DPA's investigative report, which is informally circulated within the EDPB.

Both the Austrian and the Dutch DPA are ignoring these requests, leaving noyb in the blue. It seems possible that one of the complaint has been lost between the Austrian DPA and the Dutch DPA.

While Austrian administrative law requires a decision within 6 months, there is an excemption for the time another EU authority needs outside of Austria. This leads to unlimited time for a decision.
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access
C009 18/1/2019 Austria UK DAZN Not Decided 1106 This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request)

Following a legal challenge against the Austrian DPA the Austrian Federal Administrative Court held that the DPA is supposed to investigate the issue of an incomplete reply to the access request (rather than the issue of no reply at all, as DAZN had provided some information).

The Austrian DPA ignored this for over a year. In December 2021 noyb filed a second case against the Austrian DPA to order the DPA to act. 
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access
C010 18/1/2019 Austria UK DAZN Not Decided 1106 This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request)

The case was brought before Brexit and referred to the UK DPA by the Austrian DPA, assuming the UK DPA is acting as a lead supervisory authority. noyb was not informed of any progress during this time by either authority.

After Brexit, it seems that the Austrian DPA is competent as the UK DPA is not operating under the GDPR anymore. However, the Austrian DPA doesn't seem to deal with the case and ignores requests for updates. noyb is left in the blue about thet status of the complaint and will bring the case to the attention of the courts shortly.
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access
C011 18/1/2019 Austria Germany (Berlin) Soundcloud Not Decided 1106 This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request)

In August 2021, noyb filed a reply to the controller's statement on the complaint, which has apparently existed since July 2017 but has only been forwarded to noyb in August 2021. No reasons for this delay were shared with noyb, but it seems that the cooperation between the Austrian and the Berlin DPA were not ideal - despite similar procedures and a joint procedural language.

While Austrian administrative law requires a decision within 6 months, there is an excemption for the time another EU authority needs outside of Austria. This leads to unlimited time for a decision.
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access
C012 11/11/2021 n/a Austria Grindr LLC Not Decided 78 This case is very recent and concerns the way Grindr authenticated users who tried to exercised their rights. It seems to be followed-up swiftly by the Austrian DPA, as there is no need for cooperation with other DPAs. So far, we have no concern about the way the procedure is handled. https://noyb.eu/en/want-your-grindr-data-show-your-id-and-take-selfie
C013 18/1/2019 n/a Austria Flimmit Decided 1106 This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. This is the only case that did not require cooperation with other DPAs and is the only one that was decided so far.

In September 2020, and after noyb filed a lawsuit with the Austrian Federal Administrative Court over inactivity, the Austrian DPA finally decided the case. During the course of the procedure, the controller provided the missing information under Article 15 GDPR within the course of the procedure. The case was therefore closed.

While the statutory deadline of 6 months was overrun considerably, this is the only case that was decided.
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access
C014 18/1/2019 Austria Ireland YouTube (Google) Not Decided 1106 This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request)

There are still disputes about the lead supervisory authority (LSA) for Google, as Google has engaged in "forum shopping" in 2019. noyb asked the Federal Asministrative Court (BVwG) to decide that the Austrian DPA is competent to handle the case. The case before the Irish DPA was considered moot until the BVwG's decision. The BVwG held that it is up for the DPAs to (jointly) decide which DPA is competent. The Irish DPA in turn asked noyb if we agree that they are the LSA. We do not agree, but informed the Irish DPA that it is primarly up to the DPAs to make such a call and for noyb to potentially challenge any decision over a lack of authority.

It seems, the investigation has not even been started, despite the case being filed three years ago.
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access
C015 18/1/2019 Austria Sweden Spotify Not Decided 1106 This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far not a single case has seen a decision.

In August 2020, noyb tried to follow up with the Austrian DPA, which had promised that a decision was to be expected "within the next weeks". There is no information from either the Austrian or the Swedish DPA since then. Three years after the complaint was filed, there is still no decision in sight.
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access
C016 18/1/2019 Austria Luxembourg Amazon Not Decided 1106 This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request)

In November 2021, noyb tried to follow up with the Austrian DPA, as the last update from the DPA was 9 months earlier. Nothing from either the Austrian or the Luxembourgish DPA since then. Three years after the complain was filed, there is no decision in sight.
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access
C017 18/1/2019 Austria Ireland Apple Not Decided 1106 This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request)

In June 2021, the Irish DPA finally provided noyb with the controller's reply to the complaint, after information by the Irish DPA that submissions were supposedly incomplete and documents were missing. noyb reapeatedly pointed out to have provided everything to the Austrian DPA, as required under the law. Nevertheless, the Irish DPA only provided the controller with a fraction of the documents. Consequently, the controller's reply does not cover the issues raised in the complaint. It seems that certain documents were not properly exchanged between the Austrian and Irish DPAs via the IMI system.

This case is a typical situation where the current IMI system made it complicated for communciation between DPAs and for the complainant. Three years after the complain was filed, there is no decision in sight.
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access
C018 10/12/2019 n/a France Webedia; AppNexus Not Decided 780 Given the experiance with the "cooperation mechanism" this case was filed directly with the lead authority (the French CNIL).

In April 2020 the French CNIL informed us that it is investigating and will get back to noyb in due time. A reminder was sent to the CNIL in January 2021. So far there was no update.

The case has not been decided on for more than two years.
https://noyb.eu/en/say-no-cookies-yet-see-your-privacy-crumble
C019 10/12/2019 n/a France Conde Nast; PubMatic - Vanityfair Not Decided 780 Given the experience with the "cooperation mechanism" this case was filed direclty with the lead supervisory authority (the French CNIL).

The French DPA (CNIL) informed noyb that investigations started in March 2020. In October 2021, the CNIL informed us that the processing and sharing of user data with other partners has been stopped on the controllers website. The website has also been notified to obtain consent before dropping a cookie on users' terminal. CNIL told noyb that it will continue the inspection and will come back to noyb in due time. Since then, there has been no further information.
https://noyb.eu/en/say-no-cookies-yet-see-your-privacy-crumble
C020 10/12/2019 n/a France Cdiscount; Facebook Not Decided 780 Given the experience with the "cooperation mechanism", this case was filed directly with the lead authority (the French CNIL).

In April 2020, the CNIL informed us that it is investigating and will get back to noyb in due time. We sent a reminder in January 2021. So far, there was no update or decision.
https://noyb.eu/en/say-no-cookies-yet-see-your-privacy-crumble
C021 14/1/2020 n/a Norway Grindr; MoPub; AppNexus; OpenX Partly Decided 745 This complaint is connected to the complaints on Grindr and online advertisment.

In this case there is no lead supervisory authority as Grindr does not have a main office in the EU. noyb worked together with the Norwegian Consumer Council (NCC) who submitted the case directly with the local DPA in Norway.

The case was handled in English and was prioritized by the Norwegian DPA. There was a draft decision by the Norwegian DPA that both parties were heard on. The final decision was issued in December 2021, less than two years after the initial complaint.

There is no decision on MoPub, AppNexus and OpenX so far.
https://noyb.eu/en/three-gdpr-complaints-filed-against-grindr-twitter-and-adtech-companies-smaato-openx-adcolony-and
C022 14/1/2020 n/a Norway Grindr; AdColony Not Decided 745 This complaint is connected to the complaints on Grindr and online advertisment.

In this case there is no lead supervisory authority as Grindr does not have a main office in the EU. noyb worked together with the Norwegian Consumer Council (NCC) who submitted the case directly with the local DPA in Norway.

The case was handled in English and was prioritized by the Norwegian DPA. There was a draft decision by the Norwegian DPA that both parties were heard on. The final decision was issued in December 2021, less than two years after the initial complaint.

There is no decision on AdColony so far.
https://noyb.eu/en/three-gdpr-complaints-filed-against-grindr-twitter-and-adtech-companies-smaato-openx-adcolony-and
C023 14/1/2020 Norway Germany (Hamburg) Grindr; Smaato Not Decided 745 This complaint is connected to the complaints on Grindr and online advertisment.

The lead supervisory authority for Smaato is the Hamburg DPA. In July 2021 the Hamburg DPA informed the Norwegian DPA (Datatilsynet) the investigation into Smaato is well under way. Since then, no news on the case.
https://noyb.eu/en/three-gdpr-complaints-filed-against-grindr-twitter-and-adtech-companies-smaato-openx-adcolony-and
C024 3/02/2020 Germany (Bavaria) Luxembourg Amazon Not Decided 725 This case concerned problematic email server settings by Amazon. It was filed with the Bavarian DPA and forwarded to the Luxembourg DPA, being the lead supervisory authority for Amazon in Europe.

In October 2020, the Bavarian DPA informed noyb that the Luxembourg DPA has prepared an initial analysis of the case. No further information has been provided since then.
https://noyb.eu/en/project/encryption-privacy-design
C025 18/2/2020 n/a Germany (Hamburg) Clearview AI Not Decided 710 This case is about the collection and use of publicly available photos of faces from websites by Clearview. Clearview uses the images to create a biometric database of faces and their photos. Its customers can use a photo of a face to search the database to find other photos of the face. The results show all photos in Clearview's database and where they were scraped from.

There is no lead supervisory authority in the EU because Clearview has no offices in the EU.

The case was filed with the local DPA of the complainant: the Hamburg DPA. The DPA received submissions from Clearview and the complainant. The case is ripe for decision but it seems that the Hamburg DPA does not want to issue a decision.
https://noyb.eu/en/clearview-ai-deemed-illegal-eu
C026 13/5/2020 n/a Austria Google (AAID) Not Decided 625 Google LLC argues that the Austrian DPA is not competent for the processing connected to the OS Android, but that this case should be decided by the Irish DPA (DPC), despite the fact that it is filed agains the US entitiy of Google (Google LLC).

noyb has replied in September 2021 and is now waiting for a decision on the "forum shopping" approach of Google.
https://noyb.eu/en/complaint-filed-against-google-tracking-id
C027 2/10/2020 n/a Austria A1 Telekom Austria Decided (Appealed) 483 This case is a purely national case, regarding incomplete access under Article 15 GDPR to traffic and geolocation data processed by A1, the national phone carrier of Austria. The practices of A1 were accepted by the Austrian DPA.

In November 2021, noyb filed an appeal against the decision by the Austrian DPA before the Federal Administrative Court. Despite a six month deadline, there has not been a decision by the Court so far.
https://noyb.eu/en/a1-where-were-you-none-your-business
C028 31/7/2020 n/a Austria CRIF Decided (Appealed) 546 This is a purely national case on unlawful processing operations by the credit reference agency CRIF. The decision of the Austrian DPA partially upheld and partially dismissed the complaint. Its reasoning partially referred to an undisclosed decision (a result of an ex officio procedure) on CRIF, which makes it impossible to understand for noyb.

Both CRIF and noyb have filed appeals against the decion of the Austrian DPA. An ongoing exchange of submissions will take place before the Federal Administraive Court.
https://noyb.eu/en/credit-scoring-negative-credit-rating-generated-without-data
C029 18/8/2020 n/a n/a 101 complaints Partly Decided 528 These cases concern 101 websites that transfers personal data to the United States after the "Schrems II" judgment via Google Analytics and Facebook.

The first final decision was issued by the Austrian Austrian DPA in January 2022, upholding noyb's complaint against the website provider. The other 100 cases were forwared to almost every DPA in the European Union. Many are currently processed, including submissions by the repondents and submissions by noyb. For some, there was no information or submissions about 1.5 years into the complaints procedure. In detail, as of January 2022
- 1 case has been decided on the merits
- 1 case has been dismissed, as the website provider seems to not have used the relevant website tools
- 4 cases have been withdrawn by noyb
- 3 cases appear to have been "lost" as the Bulgarian DPA persistently denies to have received them, despite noyb resubmitting them several times
- the status of almost 60 complaints is entirely unclear as noyb has received no more than confirmations of receipt or a notice, that the case has been passen on to the respective lead supervisory authority
- as for the rest, there has been at least some exchange of submissions with the respondents or update reports from the DPA. However, the last communication often dates back over a year, and most request for updates are are ignored by the DPAs so far, so it seems unclear when a decision is to be expected.
https://noyb.eu/en/101-complaints-eu-us-transfers-filed
C030 13/10/2020 n/a Austria AZ Direct Not Decided 472 This is a case on an address broker ("AZ Direct") that refused to provide information on the origin and recipients of the data processed.

Facing the lack of action from the Austrian DPA (DSB), which is obliged by law to take a decision within 6 months, noyb filed an lawsuit against the DSB with the Federal Administraive Court. The court case is still pending, under the law the court will have to decide within 6 months.
https://noyb.eu/en/address-broker-gdpr-compliance-too-burdensome
C031 11/12/2020 n/a Malta C-Planet Decided 413 noyb filed a complaint with the Maltese DPA after the data breach. On 17 January 2022, the Maltese DPA issued a decision following the arguments made in our complaint.

The origin of the data that was breached was, however, not revealed to the complainants, as the Maltese DPA did not provide the submissions in the case or heard noyb and also removed the name of the data source in the decision. It is likely that the data source is a public entity or political party.

Hopefull, this information will be revealed within the parallel class action filed by the Daphne foundation in Malta.
https://noyb.eu/en/maltese-voter-data-leaked-online-noyb-files-complaint
C032 21/10/2020 Austria Hungary WizzAir Not Decided 464 The complaint concerns the right to rectification of a passanger name for free, as provided for under the GDPR.

In May 2021, the Austrian DPA (DSB) informed us that there was a mistake in forwarding the complaint to the Hungarian DPA. At the time of the correspondence, the Hungarian DPA was already in a posession of the complaint. noyb has been expecting to receive the respondent's submission since December 2021. More than a year after filing the complaint the respondent's submission has not been provided to noyb yet.
https://noyb.eu/en/wizz-air-eu1-flight-eu35-your-gdpr-right
C033 16/11/2020 n/a Spain Apple (IDFA) Decided (Appealed) 438 The complaint concerns the unauthorized creation of an "Ad ID" by Apple. The case was brought under the national implementation of the ePrivacy Directive (not the GDPR) in Spain.

In December 2021, the Spanish DPA (AEPD) dismissed the complaint, on the ground that the AEPD was not territorially competent for the case, since Apple was based in Ireland. There seems to be no application of Irish law in a Spanish case either. The case would likely not be decided by either DPA.

noyb filed an appeal against this decision, since the decision leaves the Spanish citizen without remedy in Spain.
https://noyb.eu/en/noyb-files-complaints-against-apples-tracking-code-idfa
C034 24/11/2020 n/a Germany (Bayern) Apple (IDFA) Not Decided 430 The complaint concerns the unauthorized creation of an "Ad ID" by Apple. The case was brought under the national implementation of the ePrivacy Directive (not the GDPR) in Germany.

In July 2021, the Bavarian DPA informed noyb that Apple had provided their submissions and further news would be shared by the end of September 2021. Since then, noyb did not receive any updates.
https://noyb.eu/en/noyb-files-complaints-against-apples-tracking-code-idfa
C035 22/1/2021 n/a EDPS MEP vs EC Decided 371 The case concerned the European Parliament's COVID testing page for various violations, including EU-US data transfers, lack of proper cookie consent and conflicting information on the data protection policy.

The EU DPA (EDPS) adopted a decision on 5 January 2022, upholding noyb's position.
https://noyb.eu/en/data-transfers-us-and-insufficient-cookie-information-noyb-files-complaint-against-european
C036 3/02/2021 n/a Austria Clubhouse Not Decided 359 This minor complaint concerns the then trending app "clubhouse". As there is no main establishment in the EU, the case did not go through the "one stop shop" mechanism.

In October 2021, noyb filed a reply to Clubhouse's reply. noyb is waiting for a decision by the Austrian DPA.
no PR
C037 8/10/2021 n/a n/a Cookie banners ("Dark patterns") Not Decided 112 noyb filed a total number of 463 complaints with 20 different DPAs in August 2021. The European Data Protection Board (EDPB) set up a taskforce to coordinate the response to noyb's complaints. noyb withdrew three complaints as the controllers remedied all violations after the filing of the complaints.

The DPAs in Malta, Belgium, Baden-Württemberg, Bavaria, Berlin, Hamburg, BfDI, Brandenburg, North Rhine-Westphalia, Rhineland-Palatinate, Saarland, France, Ireland, Luxembourg, Liechtenstein, Poland, Austria - confirmed the receipt of complaints and in some cases even facilitated the exchange of submissions between the controllers and noyb.

noyb has not received any reaction from the authorities in Spain, Italy, and Norway yet.
https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-cookie-banners
C038 18/3/2021 n/a Austria CRIF; AZ Direct Not Decided 316 The case concerns data sharing between address publishers and credit ranking agencies. It does not involve the one-stop-shop and is treated as a national case by the Austrian DPA.

In August 2021, noyb submitted a final submissions after previous submissions by the respondents.

noyb is awaiting a decision.
https://noyb.eu/en/illegal-data-exchange-between-address-publisher-and-credit-ranking-agency
C039 22/08/2021 n/a Austria KSV 1870 Not Decided 159 The case concerns the credit referency agency KSV 1870. It does not involve the one-stop-shop and is treated as a national case by the Austrian DPA.

In September 2021, noyb submitted final replies on the respondents' submissions.

noyb is awaiting a decision.
https://noyb.eu/en/right-access-data-protection-boomerang
C040 22/10/2021 Austria Luxembourg Amazon Not Decided 98 The case concerns the automatic decision when trying to pay using to Amazon Monthly Invoice" service.

In December 2021, the Austrian DPA informed us that the case has been forwarded to Luxembourg as the lead supervisory authority. We are waiting for an update from the DPAs.
https://noyb.eu/en/black-box-amazon-algorithm-discriminates-customers
C041 4/07/2021 n/a France Google (AAID) Not Decided 208 The case concerns the unauthorized creation of an Ad ID on Google Andorid devices.

In July 2021, the French DPA (CNIL) confirmed that the investigation was still ongoing. Since then, we did not receive any updates.
https://noyb.eu/en/buy-phone-get-tracker-unauthorized-tracking-code-illegally-installed-android-phones
C042 31/7/2020 Germany (Hamburg) Poland PimEyes Not Decided 546 This case is about the collection and use of publicly available photos of faces from websites by Pimeyes. Pimeyes uses the images to create a biometric database of faces and their photos. Its customers can use a photo of a face to search the database to find other photos of the face. The results show all photos in Pimeyes's database and where they were scraped from.

In May 2021, noyb stepped in to represent a complainant from Hamburg and submitted applications on the lack of action of the Polish Data Protection Authority (which is the lead superviory authority in this case). In July 2021, the Hamburg DPA indicated that they might take steps on their own as the lead Polish DPA is unresponsive.
None
C043 27/5/2021 n/a Austria Clearview AI Not Decided 246 This case is about the collection and use of publicly available photos of faces from websites by Clearview. Clearview uses the images to create a biometric database of faces and their photos. Its customers can use a photo of a face to search the database to find other photos of the face. The results show all photos in Clearview's database and where they were scraped from.

There is no lead supervisory authority in the EU because Clearview has no offices in the EU.

The case was filed with the local DPA of the complainant: the Austrian DPA. The DPA received submissions from Clearview and the complainant in December 2021. Waiting for the next step with the Austrian DPA.
https://noyb.eu/en/digital-rights-alliance-file-legal-complaints-against-facial-recognition-company-clearview-ai
C044 18/10/2021 n/a Germany (Bavaria) C044 - CRIF Bürgel + Acxiom Not Decided 102 The case concerns the German credit reference agency CRIF Bürgel and it's data supplier Acxiom (an address trader). It does not involve the one-stop-shop and was directly filed with the Bavarian DPA. In December 2021, the Bavarian DPA informed noyb that they have asked the credit reference agency to reply to the complaint. The Hessian DPA, which is handling the part of the complaint against the address publisher will most likely also ask them for a reply. https://noyb.eu/en/illegal-credit-scores-noyb-amplify-pressure
C045 13/8/2021 n/a Germany (Hamburg) Spiegel Not Decided 168 This case concerns the "pay or okay" approach by various news outlets.

No status update was provided to noyb.
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price
C046 13/8/2021 n/a Austria DerStandard Not Decided 168 This case concerns the "pay or okay" approach by various news outlets.

After noyb's and DerStandard's submission, we are waiting for next step.
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price
C047 13/8/2021 n/a Germany (Hamburg) ZEIT Not Decided 168 This case concerns the "pay or okay" approach by various news outlets.

No status update was provided to noyb.
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price
C048 13/8/2021 n/a Germany (Niedersachsen) heise Not Decided 168 This case concerns the "pay or okay" approach by various news outlets.

No status update was provided to noyb.
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price
C049 13/8/2021 n/a Austria Krone Not Decided 168 This case concerns the "pay or okay" approach by various news outlets.

noyb is submitting its submission in February 2022 after Krone's submission. Waiting for the next steps and awaiting a decision within 6 months of the complaint.
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price
C050 13/8/2021 n/a Germany (NRW) t-online Not Decided 168 This case concerns the "pay or okay" approach by various news outlets.

No status update was provided to noyb.
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price
C051 13/8/2021 n/a Germany (Hessen) FAZ Not Decided 168 This case concerns the "pay or okay" approach by various news outlets.

No status update was provided to noyb.
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price
C052 22/11/2021 n/a Irish DPA (Ireland) Airbnb Not Decided 67 This case concerns automated decisons on Airbnb host ratings.

The Rheinland-Pfalz DPA confirmed receipt of the complaint in December 2021. Waiting for next steps and updates, which may include forwarding the case to the Irish DPA, as Airbnb claims to have their Euopean headquarter in Ireland.
https://noyb.eu/en/gdpr-complaint-airbnb-hosts-mercy-algorithms
C053 22/12/2021 n/a CNPD (Luxemburg) Amazon Not Decided 37 This case concerns automated decision making when signing up to become an "Amazon Turk".

The Luxemburg DPA acknowledged receiving the complaint on 29/12/2021. Waiting for the next steps and udpates.
https://noyb.eu/en/complaint-filed-help-my-recruiter-algorithm