| Case | Lodged | CSA | LSA | Company | Status | Duration | Summary | More info |
| C001 | 25/5/2018 | France | Ireland | Partly Decided | 1344 | The complaint is one of four complaints on "forced consent" (see C001 to C004). The issue is that the user is forced to consent to the processing of their personal data to use the service. Therefore, such consent cannot be considered as free which is a condition for its validity. After a complaint filed on 25 May 2018, the French DPA (CNIL) adopted a decision in January 2019, fining Google € 50 million. The CNIL then sent the case to the Irish DPA (DPC) for the remaining elements, as Google claimed its main establishment in Europe to be in Ireland. On 25 January 2022, the CNIL informed noyb that the case was sent back to the CNIL by the DPC, that considers that Google LLC is the controller for this case. The CNIL informed us that it will ask the EDPB to adopt a decision under Article 65(1)(b) GDPR. |
https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook | |
| C002 | 25/5/2018 | Austria | Ireland | Not Decided | 1344 | The complaint is one of four complaints on "forced consent" (see C001). After the complaint was filed in Austria, it was sent to the Irish DPA (DPC) as the lead supervisory authority. The DPC stated the case would be treated as a "pathfinder" for the other three pending "forced consent" cases. Soon after, a "six step procedure" was started. A draft investigator report, a final investigator report, a preliminary draft decision and a final draft decision were delivered - each about 100 pages long. While the reports are repetative, the overall time taken to issue these reports was about 3.5 years. Nevertheless, the Irish DPA has not provided all documents to noyb and has therefore not allowed for a fair hearing. Allegations of "confidential" meetings between the DPC and Facebook have further added to the highly problematic procedure that may be overturned. The final "draft decision" of the DPC was rejected by other European data protection authorities under Article 60(4) GDPR. This was not surprising, as the Irish DPA openly refused to accept the legal view of the other DPAs that was expressed in an EDPB guideline in 2020. The DPC is now reconsidering the draft decision, but has removed noyb from the procedure over alleged "confidentialty" of documents. There is no active co-decisionmaking between the two authorities. The Austrian DPA (DSB) acts as a translator in the case and performs machine translations and forwards documents. The Austrian DPA has tried to get relevant documents from the DPC, but had troubles to ensure full disclosure of all the documents filed by the DPC. The DSB also started an open fight with the DPC over the scope of the procedure, which the DPC tried to limit. |
https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook | |
| C003 | 25/5/2018 | Belgium | Ireland | Instagram (Facebook) | Not Decided | 1344 | The complaint is one of four complaints on "forced consent" (see C001). It was filed in Belgium and forwarded to the Irish DPA (Irish DPA) as the lead supervisory authority. Soon after, a "six step procedure" was started. A draft investigator report, a final investigator report, a preliminary draft decision and a - each about 100 pages long. While the reports are repetative, the overall time taken to issue these reports was about 3.5 years. Nevertheless, the Irish DPA has not provided all documents to noyb and has therefore not allowed for a fair hearing. Allegations of "confidential" meetings between the Irish DPA and Facebook have further added to the highly problematic procedure that may be overturned. Despite the other DPAs rejecting the legal views of the Irish DPA in the "pathfinder" case on Facebook (see above) the Irish DPA has nevertheless just copy/pasted the decision, with no prospects of being able to win a majority among the DPAs. There is no active co-decisionmaking between the two authorities. While the Belgian DPA (APD) seemed to act as a mere mailbox in the beginning, they now asked the Irish DPA to decide on which national procedure should be applicable. Since the complaint was filed in Belgium, an oral hearing should be held and documents and procedures should be in French. |
https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook |
| C004 | 25/5/2018 | Germany (BfDI) | Ireland | WhatsApp (Facebook) | Not Decided | 1344 | The complaint is one of four complaints on "forced consent". It was filed in Hamburg and forwarded to the Federal German DPA (BfDI) and then Irish DPA (DPC) as the lead supervisory authority. Soon after, a "six step procedure" was started. A draft investigator report, a final investigator report, a preliminary draft decision and a final draft decision were delivered - each about 100 pages long. While the reports are repetative, the overall time taken to issue these reports was about 3.5 years. Nevertheless, the DPC has not provided all documents to noyb and has therefore not allowed for a fair hearing. Allegations of "confidential" meetings between the DPC and Facebook have further added to the highly problematic procedure that may be overturned. Despite the other DPAs rejecting the legal views of the DPC in the "pathfinder" case on Facebook (see above), the DPC has neverthless just copy/pasted the decision, with no prospects of being able to win a majority among DPAs. There is no active co-decisionmaking between the two authorities, as the BfDI seems to mainly translate and forwards documents. The BfDI has tried to get relevant documents from the DPC, but had troubles to ensure full disclosure of all filed documents by the DPC. |
https://noyb.eu/en/noybeu-filed-complaints-over-forced-consent-against-google-instagram-whatsapp-and-facebook |
| C005 | 3/12/2018 | n/a | France | Criteo | Not Decided | 1152 | This case concerns the freedom to choose any form (like email or letters) to exercise GDPR rights, while companies often require to use very complicated online forms, plugins or other obscure methods. This case is with the French DPA (CNIL). We were told that due to high workloads and the need to cooperate with other DPAs (Germany, Belgium, Sweden, Norway, Spain, Denmark, Italy, Poland, Cyprus, Slovenia, Austria, Portugal) this case moved very slowly. |
https://noyb.eu/en/test-cases-freedom-exercise-gdpr-rights-any-format |
| C006 | 11/12/2018 | Austria | Ireland | Not Decided | 1144 | This case concerns the freedom to choose any form (like email or letters) to exercise GDPR rights, while companies often require very complicated online forms, plugins or other obscure methods. This case is on opting out of Google's data processing. The case was filed in Austria and is stalled due to unclear responsibilities, as Google claims that the Irish DPA (DPC) is the lead supervisory authority. |
https://noyb.eu/en/test-cases-freedom-exercise-gdpr-rights-any-format | |
| C007 | 18/1/2019 | Austria | Netherlands | Netflix | Not Decided | 1106 | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request). This case seems to be lost beween Austria and the Netherlands. Is is unclear which cases were recorded in the Netherlands and if any steps by the Dutch DPA were taken by now. In October 2021, noyb repeated its request with the Austrian DPA (already made in March and June 2021), to approach the Dutch DPA (lead supervisory authority) to clarify: 1) if the Dutch DPA is handling both cases (C007 and C008) or only one of them (the Dutch DPA only assigned one case number but never mentioned a complainant) 2) if the complainants are even considered as parties to the procedure(s) 3) if the parties can have access to the Dutch DPA's investigative report, which is informally circulated within the EDPB. Both the Austrian and the Dutch DPA are ignoring these requests, leaving noyb in the blue. It seems possible that one of the complaints has been lost between the Austrian DPA and the Dutch DPA. While Austrian administrative law requires a decision within 6 months, there is an excemption for the time another EU authority needs outside of Austria. This leads to an unlimited time for a decision. |
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C008 | 18/1/2019 | Austria | Netherlands | Netflix | Not Decided | 1106 | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request) This case seems to be lost beween Austria and the Netherlands. Is is unclear which cases were recorded in the Netherlands and if any steps by the Dutch DPA were taken by now. In October 2021, noyb repeated its request with the Austrian DPA already made in March and June 2021, to approach the Dutch DPA (lead supervisory authority) to clarify: 1) if the Dutch DPA is handling both cases (C007 and C008) or only one of them (the Dutch DPA only assigned one case number but never mentioned a complainant) 2) if the complainants are even considered as parties to the procedure(s) 3) if the parties can have access to the Dutch DPA's investigative report, which is informally circulated within the EDPB. Both the Austrian and the Dutch DPA are ignoring these requests, leaving noyb in the blue. It seems possible that one of the complaint has been lost between the Austrian DPA and the Dutch DPA. While Austrian administrative law requires a decision within 6 months, there is an excemption for the time another EU authority needs outside of Austria. This leads to unlimited time for a decision. |
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C009 | 18/1/2019 | Austria | UK | DAZN | Not Decided | 1106 | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request) Following a legal challenge against the Austrian DPA the Austrian Federal Administrative Court held that the DPA is supposed to investigate the issue of an incomplete reply to the access request (rather than the issue of no reply at all, as DAZN had provided some information). The Austrian DPA ignored this for over a year. In December 2021 noyb filed a second case against the Austrian DPA to order the DPA to act. |
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C010 | 18/1/2019 | Austria | UK | DAZN | Not Decided | 1106 | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request) The case was brought before Brexit and referred to the UK DPA by the Austrian DPA, assuming the UK DPA is acting as a lead supervisory authority. noyb was not informed of any progress during this time by either authority. After Brexit, it seems that the Austrian DPA is competent as the UK DPA is not operating under the GDPR anymore. However, the Austrian DPA doesn't seem to deal with the case and ignores requests for updates. noyb is left in the blue about thet status of the complaint and will bring the case to the attention of the courts shortly. |
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C011 | 18/1/2019 | Austria | Germany (Berlin) | Soundcloud | Not Decided | 1106 | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request) In August 2021, noyb filed a reply to the controller's statement on the complaint, which has apparently existed since July 2017 but has only been forwarded to noyb in August 2021. No reasons for this delay were shared with noyb, but it seems that the cooperation between the Austrian and the Berlin DPA were not ideal - despite similar procedures and a joint procedural language. While Austrian administrative law requires a decision within 6 months, there is an excemption for the time another EU authority needs outside of Austria. This leads to unlimited time for a decision. |
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C012 | 11/11/2021 | n/a | Austria | Grindr LLC | Not Decided | 78 | This case is very recent and concerns the way Grindr authenticated users who tried to exercised their rights. It seems to be followed-up swiftly by the Austrian DPA, as there is no need for cooperation with other DPAs. So far, we have no concern about the way the procedure is handled. | https://noyb.eu/en/want-your-grindr-data-show-your-id-and-take-selfie |
| C013 | 18/1/2019 | n/a | Austria | Flimmit | Decided | 1106 | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. This is the only case that did not require cooperation with other DPAs and is the only one that was decided so far. In September 2020, and after noyb filed a lawsuit with the Austrian Federal Administrative Court over inactivity, the Austrian DPA finally decided the case. During the course of the procedure, the controller provided the missing information under Article 15 GDPR within the course of the procedure. The case was therefore closed. While the statutory deadline of 6 months was overrun considerably, this is the only case that was decided. |
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C014 | 18/1/2019 | Austria | Ireland | YouTube (Google) | Not Decided | 1106 | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request) There are still disputes about the lead supervisory authority (LSA) for Google, as Google has engaged in "forum shopping" in 2019. noyb asked the Federal Asministrative Court (BVwG) to decide that the Austrian DPA is competent to handle the case. The case before the Irish DPA was considered moot until the BVwG's decision. The BVwG held that it is up for the DPAs to (jointly) decide which DPA is competent. The Irish DPA in turn asked noyb if we agree that they are the LSA. We do not agree, but informed the Irish DPA that it is primarly up to the DPAs to make such a call and for noyb to potentially challenge any decision over a lack of authority. It seems, the investigation has not even been started, despite the case being filed three years ago. |
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C015 | 18/1/2019 | Austria | Sweden | Spotify | Not Decided | 1106 | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far not a single case has seen a decision. In August 2020, noyb tried to follow up with the Austrian DPA, which had promised that a decision was to be expected "within the next weeks". There is no information from either the Austrian or the Swedish DPA since then. Three years after the complaint was filed, there is still no decision in sight. |
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C016 | 18/1/2019 | Austria | Luxembourg | Amazon | Not Decided | 1106 | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request) In November 2021, noyb tried to follow up with the Austrian DPA, as the last update from the DPA was 9 months earlier. Nothing from either the Austrian or the Luxembourgish DPA since then. Three years after the complain was filed, there is no decision in sight. |
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C017 | 18/1/2019 | Austria | Ireland | Apple | Not Decided | 1106 | This case is part of a series of complaints on incomplete answers to access requests (a very common problem). These cases were also intended to develop further information on the functioning of the EU cooperation mechanism. So far, only one case has been decided (only after a court's intervention at noyb's request) In June 2021, the Irish DPA finally provided noyb with the controller's reply to the complaint, after information by the Irish DPA that submissions were supposedly incomplete and documents were missing. noyb reapeatedly pointed out to have provided everything to the Austrian DPA, as required under the law. Nevertheless, the Irish DPA only provided the controller with a fraction of the documents. Consequently, the controller's reply does not cover the issues raised in the complaint. It seems that certain documents were not properly exchanged between the Austrian and Irish DPAs via the IMI system. This case is a typical situation where the current IMI system made it complicated for communciation between DPAs and for the complainant. Three years after the complain was filed, there is no decision in sight. |
https://noyb.eu/en/netflix-spotify-youtube-eight-strategic-complaints-filed-right-access |
| C018 | 10/12/2019 | n/a | France | Webedia; AppNexus | Not Decided | 780 | Given the experiance with the "cooperation mechanism" this case was filed directly with the lead authority (the French CNIL). In April 2020 the French CNIL informed us that it is investigating and will get back to noyb in due time. A reminder was sent to the CNIL in January 2021. So far there was no update. The case has not been decided on for more than two years. |
https://noyb.eu/en/say-no-cookies-yet-see-your-privacy-crumble |
| C019 | 10/12/2019 | n/a | France | Conde Nast; PubMatic - Vanityfair | Not Decided | 780 | Given the experience with the "cooperation mechanism" this case was filed direclty with the lead supervisory authority (the French CNIL). The French DPA (CNIL) informed noyb that investigations started in March 2020. In October 2021, the CNIL informed us that the processing and sharing of user data with other partners has been stopped on the controllers website. The website has also been notified to obtain consent before dropping a cookie on users' terminal. CNIL told noyb that it will continue the inspection and will come back to noyb in due time. Since then, there has been no further information. |
https://noyb.eu/en/say-no-cookies-yet-see-your-privacy-crumble |
| C020 | 10/12/2019 | n/a | France | Cdiscount; Facebook | Not Decided | 780 | Given the experience with the "cooperation mechanism", this case was filed directly with the lead authority (the French CNIL). In April 2020, the CNIL informed us that it is investigating and will get back to noyb in due time. We sent a reminder in January 2021. So far, there was no update or decision. |
https://noyb.eu/en/say-no-cookies-yet-see-your-privacy-crumble |
| C021 | 14/1/2020 | n/a | Norway | Grindr; MoPub; AppNexus; OpenX | Partly Decided | 745 | This complaint is connected to the complaints on Grindr and online advertisment. In this case there is no lead supervisory authority as Grindr does not have a main office in the EU. noyb worked together with the Norwegian Consumer Council (NCC) who submitted the case directly with the local DPA in Norway. The case was handled in English and was prioritized by the Norwegian DPA. There was a draft decision by the Norwegian DPA that both parties were heard on. The final decision was issued in December 2021, less than two years after the initial complaint. There is no decision on MoPub, AppNexus and OpenX so far. |
https://noyb.eu/en/three-gdpr-complaints-filed-against-grindr-twitter-and-adtech-companies-smaato-openx-adcolony-and |
| C022 | 14/1/2020 | n/a | Norway | Grindr; AdColony | Not Decided | 745 | This complaint is connected to the complaints on Grindr and online advertisment. In this case there is no lead supervisory authority as Grindr does not have a main office in the EU. noyb worked together with the Norwegian Consumer Council (NCC) who submitted the case directly with the local DPA in Norway. The case was handled in English and was prioritized by the Norwegian DPA. There was a draft decision by the Norwegian DPA that both parties were heard on. The final decision was issued in December 2021, less than two years after the initial complaint. There is no decision on AdColony so far. |
https://noyb.eu/en/three-gdpr-complaints-filed-against-grindr-twitter-and-adtech-companies-smaato-openx-adcolony-and |
| C023 | 14/1/2020 | Norway | Germany (Hamburg) | Grindr; Smaato | Not Decided | 745 | This complaint is connected to the complaints on Grindr and online advertisment. The lead supervisory authority for Smaato is the Hamburg DPA. In July 2021 the Hamburg DPA informed the Norwegian DPA (Datatilsynet) the investigation into Smaato is well under way. Since then, no news on the case. |
https://noyb.eu/en/three-gdpr-complaints-filed-against-grindr-twitter-and-adtech-companies-smaato-openx-adcolony-and |
| C024 | 3/02/2020 | Germany (Bavaria) | Luxembourg | Amazon | Not Decided | 725 | This case concerned problematic email server settings by Amazon. It was filed with the Bavarian DPA and forwarded to the Luxembourg DPA, being the lead supervisory authority for Amazon in Europe. In October 2020, the Bavarian DPA informed noyb that the Luxembourg DPA has prepared an initial analysis of the case. No further information has been provided since then. |
https://noyb.eu/en/project/encryption-privacy-design |
| C025 | 18/2/2020 | n/a | Germany (Hamburg) | Clearview AI | Not Decided | 710 | This case is about the collection and use of publicly available photos of faces from websites by Clearview. Clearview uses the images to create a biometric database of faces and their photos. Its customers can use a photo of a face to search the database to find other photos of the face. The results show all photos in Clearview's database and where they were scraped from. There is no lead supervisory authority in the EU because Clearview has no offices in the EU. The case was filed with the local DPA of the complainant: the Hamburg DPA. The DPA received submissions from Clearview and the complainant. The case is ripe for decision but it seems that the Hamburg DPA does not want to issue a decision. |
https://noyb.eu/en/clearview-ai-deemed-illegal-eu |
| C026 | 13/5/2020 | n/a | Austria | Google (AAID) | Not Decided | 625 | Google LLC argues that the Austrian DPA is not competent for the processing connected to the OS Android, but that this case should be decided by the Irish DPA (DPC), despite the fact that it is filed agains the US entitiy of Google (Google LLC). noyb has replied in September 2021 and is now waiting for a decision on the "forum shopping" approach of Google. |
https://noyb.eu/en/complaint-filed-against-google-tracking-id |
| C027 | 2/10/2020 | n/a | Austria | A1 Telekom Austria | Decided (Appealed) | 483 | This case is a purely national case, regarding incomplete access under Article 15 GDPR to traffic and geolocation data processed by A1, the national phone carrier of Austria. The practices of A1 were accepted by the Austrian DPA. In November 2021, noyb filed an appeal against the decision by the Austrian DPA before the Federal Administrative Court. Despite a six month deadline, there has not been a decision by the Court so far. |
https://noyb.eu/en/a1-where-were-you-none-your-business |
| C028 | 31/7/2020 | n/a | Austria | CRIF | Decided (Appealed) | 546 | This is a purely national case on unlawful processing operations by the credit reference agency CRIF. The decision of the Austrian DPA partially upheld and partially dismissed the complaint. Its reasoning partially referred to an undisclosed decision (a result of an ex officio procedure) on CRIF, which makes it impossible to understand for noyb. Both CRIF and noyb have filed appeals against the decion of the Austrian DPA. An ongoing exchange of submissions will take place before the Federal Administraive Court. |
https://noyb.eu/en/credit-scoring-negative-credit-rating-generated-without-data |
| C029 | 18/8/2020 | n/a | n/a | 101 complaints | Partly Decided | 528 | These cases concern 101 websites that transfers personal data to the United States after the "Schrems II" judgment via Google Analytics and Facebook. The first final decision was issued by the Austrian Austrian DPA in January 2022, upholding noyb's complaint against the website provider. The other 100 cases were forwared to almost every DPA in the European Union. Many are currently processed, including submissions by the repondents and submissions by noyb. For some, there was no information or submissions about 1.5 years into the complaints procedure. In detail, as of January 2022 - 1 case has been decided on the merits - 1 case has been dismissed, as the website provider seems to not have used the relevant website tools - 4 cases have been withdrawn by noyb - 3 cases appear to have been "lost" as the Bulgarian DPA persistently denies to have received them, despite noyb resubmitting them several times - the status of almost 60 complaints is entirely unclear as noyb has received no more than confirmations of receipt or a notice, that the case has been passen on to the respective lead supervisory authority - as for the rest, there has been at least some exchange of submissions with the respondents or update reports from the DPA. However, the last communication often dates back over a year, and most request for updates are are ignored by the DPAs so far, so it seems unclear when a decision is to be expected. |
https://noyb.eu/en/101-complaints-eu-us-transfers-filed |
| C030 | 13/10/2020 | n/a | Austria | AZ Direct | Not Decided | 472 | This is a case on an address broker ("AZ Direct") that refused to provide information on the origin and recipients of the data processed. Facing the lack of action from the Austrian DPA (DSB), which is obliged by law to take a decision within 6 months, noyb filed an lawsuit against the DSB with the Federal Administraive Court. The court case is still pending, under the law the court will have to decide within 6 months. |
https://noyb.eu/en/address-broker-gdpr-compliance-too-burdensome |
| C031 | 11/12/2020 | n/a | Malta | C-Planet | Decided | 413 | noyb filed a complaint with the Maltese DPA after the data breach. On 17 January 2022, the Maltese DPA issued a decision following the arguments made in our complaint. The origin of the data that was breached was, however, not revealed to the complainants, as the Maltese DPA did not provide the submissions in the case or heard noyb and also removed the name of the data source in the decision. It is likely that the data source is a public entity or political party. Hopefull, this information will be revealed within the parallel class action filed by the Daphne foundation in Malta. |
https://noyb.eu/en/maltese-voter-data-leaked-online-noyb-files-complaint |
| C032 | 21/10/2020 | Austria | Hungary | WizzAir | Not Decided | 464 | The complaint concerns the right to rectification of a passanger name for free, as provided for under the GDPR. In May 2021, the Austrian DPA (DSB) informed us that there was a mistake in forwarding the complaint to the Hungarian DPA. At the time of the correspondence, the Hungarian DPA was already in a posession of the complaint. noyb has been expecting to receive the respondent's submission since December 2021. More than a year after filing the complaint the respondent's submission has not been provided to noyb yet. |
https://noyb.eu/en/wizz-air-eu1-flight-eu35-your-gdpr-right |
| C033 | 16/11/2020 | n/a | Spain | Apple (IDFA) | Decided (Appealed) | 438 | The complaint concerns the unauthorized creation of an "Ad ID" by Apple. The case was brought under the national implementation of the ePrivacy Directive (not the GDPR) in Spain. In December 2021, the Spanish DPA (AEPD) dismissed the complaint, on the ground that the AEPD was not territorially competent for the case, since Apple was based in Ireland. There seems to be no application of Irish law in a Spanish case either. The case would likely not be decided by either DPA. noyb filed an appeal against this decision, since the decision leaves the Spanish citizen without remedy in Spain. |
https://noyb.eu/en/noyb-files-complaints-against-apples-tracking-code-idfa |
| C034 | 24/11/2020 | n/a | Germany (Bayern) | Apple (IDFA) | Not Decided | 430 | The complaint concerns the unauthorized creation of an "Ad ID" by Apple. The case was brought under the national implementation of the ePrivacy Directive (not the GDPR) in Germany. In July 2021, the Bavarian DPA informed noyb that Apple had provided their submissions and further news would be shared by the end of September 2021. Since then, noyb did not receive any updates. |
https://noyb.eu/en/noyb-files-complaints-against-apples-tracking-code-idfa |
| C035 | 22/1/2021 | n/a | EDPS | MEP vs EC | Decided | 371 | The case concerned the European Parliament's COVID testing page for various violations, including EU-US data transfers, lack of proper cookie consent and conflicting information on the data protection policy. The EU DPA (EDPS) adopted a decision on 5 January 2022, upholding noyb's position. |
https://noyb.eu/en/data-transfers-us-and-insufficient-cookie-information-noyb-files-complaint-against-european |
| C036 | 3/02/2021 | n/a | Austria | Clubhouse | Not Decided | 359 | This minor complaint concerns the then trending app "clubhouse". As there is no main establishment in the EU, the case did not go through the "one stop shop" mechanism. In October 2021, noyb filed a reply to Clubhouse's reply. noyb is waiting for a decision by the Austrian DPA. |
no PR |
| C037 | 8/10/2021 | n/a | n/a | Cookie banners ("Dark patterns") | Not Decided | 112 | noyb filed a total number of 463 complaints with 20 different DPAs in August 2021. The European Data Protection Board (EDPB) set up a taskforce to coordinate the response to noyb's complaints. noyb withdrew three complaints as the controllers remedied all violations after the filing of the complaints. The DPAs in Malta, Belgium, Baden-Württemberg, Bavaria, Berlin, Hamburg, BfDI, Brandenburg, North Rhine-Westphalia, Rhineland-Palatinate, Saarland, France, Ireland, Luxembourg, Liechtenstein, Poland, Austria - confirmed the receipt of complaints and in some cases even facilitated the exchange of submissions between the controllers and noyb. noyb has not received any reaction from the authorities in Spain, Italy, and Norway yet. |
https://noyb.eu/en/noyb-files-422-formal-gdpr-complaints-nerve-wrecking-cookie-banners |
| C038 | 18/3/2021 | n/a | Austria | CRIF; AZ Direct | Not Decided | 316 | The case concerns data sharing between address publishers and credit ranking agencies. It does not involve the one-stop-shop and is treated as a national case by the Austrian DPA. In August 2021, noyb submitted a final submissions after previous submissions by the respondents. noyb is awaiting a decision. |
https://noyb.eu/en/illegal-data-exchange-between-address-publisher-and-credit-ranking-agency |
| C039 | 22/08/2021 | n/a | Austria | KSV 1870 | Not Decided | 159 | The case concerns the credit referency agency KSV 1870. It does not involve the one-stop-shop and is treated as a national case by the Austrian DPA. In September 2021, noyb submitted final replies on the respondents' submissions. noyb is awaiting a decision. |
https://noyb.eu/en/right-access-data-protection-boomerang |
| C040 | 22/10/2021 | Austria | Luxembourg | Amazon | Not Decided | 98 | The case concerns the automatic decision when trying to pay using to Amazon Monthly Invoice" service. In December 2021, the Austrian DPA informed us that the case has been forwarded to Luxembourg as the lead supervisory authority. We are waiting for an update from the DPAs. |
https://noyb.eu/en/black-box-amazon-algorithm-discriminates-customers |
| C041 | 4/07/2021 | n/a | France | Google (AAID) | Not Decided | 208 | The case concerns the unauthorized creation of an Ad ID on Google Andorid devices. In July 2021, the French DPA (CNIL) confirmed that the investigation was still ongoing. Since then, we did not receive any updates. |
https://noyb.eu/en/buy-phone-get-tracker-unauthorized-tracking-code-illegally-installed-android-phones |
| C042 | 31/7/2020 | Germany (Hamburg) | Poland | PimEyes | Not Decided | 546 | This case is about the collection and use of publicly available photos of faces from websites by Pimeyes. Pimeyes uses the images to create a biometric database of faces and their photos. Its customers can use a photo of a face to search the database to find other photos of the face. The results show all photos in Pimeyes's database and where they were scraped from. In May 2021, noyb stepped in to represent a complainant from Hamburg and submitted applications on the lack of action of the Polish Data Protection Authority (which is the lead superviory authority in this case). In July 2021, the Hamburg DPA indicated that they might take steps on their own as the lead Polish DPA is unresponsive. |
None |
| C043 | 27/5/2021 | n/a | Austria | Clearview AI | Not Decided | 246 | This case is about the collection and use of publicly available photos of faces from websites by Clearview. Clearview uses the images to create a biometric database of faces and their photos. Its customers can use a photo of a face to search the database to find other photos of the face. The results show all photos in Clearview's database and where they were scraped from. There is no lead supervisory authority in the EU because Clearview has no offices in the EU. The case was filed with the local DPA of the complainant: the Austrian DPA. The DPA received submissions from Clearview and the complainant in December 2021. Waiting for the next step with the Austrian DPA. |
https://noyb.eu/en/digital-rights-alliance-file-legal-complaints-against-facial-recognition-company-clearview-ai |
| C044 | 18/10/2021 | n/a | Germany (Bavaria) | C044 - CRIF Bürgel + Acxiom | Not Decided | 102 | The case concerns the German credit reference agency CRIF Bürgel and it's data supplier Acxiom (an address trader). It does not involve the one-stop-shop and was directly filed with the Bavarian DPA. In December 2021, the Bavarian DPA informed noyb that they have asked the credit reference agency to reply to the complaint. The Hessian DPA, which is handling the part of the complaint against the address publisher will most likely also ask them for a reply. | https://noyb.eu/en/illegal-credit-scores-noyb-amplify-pressure |
| C045 | 13/8/2021 | n/a | Germany (Hamburg) | Spiegel | Not Decided | 168 | This case concerns the "pay or okay" approach by various news outlets. No status update was provided to noyb. |
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price |
| C046 | 13/8/2021 | n/a | Austria | DerStandard | Not Decided | 168 | This case concerns the "pay or okay" approach by various news outlets. After noyb's and DerStandard's submission, we are waiting for next step. |
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price |
| C047 | 13/8/2021 | n/a | Germany (Hamburg) | ZEIT | Not Decided | 168 | This case concerns the "pay or okay" approach by various news outlets. No status update was provided to noyb. |
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price |
| C048 | 13/8/2021 | n/a | Germany (Niedersachsen) | heise | Not Decided | 168 | This case concerns the "pay or okay" approach by various news outlets. No status update was provided to noyb. |
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price |
| C049 | 13/8/2021 | n/a | Austria | Krone | Not Decided | 168 | This case concerns the "pay or okay" approach by various news outlets. noyb is submitting its submission in February 2022 after Krone's submission. Waiting for the next steps and awaiting a decision within 6 months of the complaint. |
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price |
| C050 | 13/8/2021 | n/a | Germany (NRW) | t-online | Not Decided | 168 | This case concerns the "pay or okay" approach by various news outlets. No status update was provided to noyb. |
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price |
| C051 | 13/8/2021 | n/a | Germany (Hessen) | FAZ | Not Decided | 168 | This case concerns the "pay or okay" approach by various news outlets. No status update was provided to noyb. |
https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price |
| C052 | 22/11/2021 | n/a | Irish DPA (Ireland) | Airbnb | Not Decided | 67 | This case concerns automated decisons on Airbnb host ratings. The Rheinland-Pfalz DPA confirmed receipt of the complaint in December 2021. Waiting for next steps and updates, which may include forwarding the case to the Irish DPA, as Airbnb claims to have their Euopean headquarter in Ireland. |
https://noyb.eu/en/gdpr-complaint-airbnb-hosts-mercy-algorithms |
| C053 | 22/12/2021 | n/a | CNPD (Luxemburg) | Amazon | Not Decided | 37 | This case concerns automated decision making when signing up to become an "Amazon Turk". The Luxemburg DPA acknowledged receiving the complaint on 29/12/2021. Waiting for the next steps and udpates. |
https://noyb.eu/en/complaint-filed-help-my-recruiter-algorithm |