On 23 August 2023, the non-profit organisation NOYB released its annual report of 2022. It celebrated the most important winning decisions on the data transfer complaints against the EU Parliament, declaring the illegality of the transfer of user data to the U.S. implementing “Schrems II”. Also, it affirmed the illicitness of persisting in using Google Analytics and the fine of (e) 390 mil against Meta for its systematic “forced consent”.
Image by Freepik
The Report highlighted NOYB’s projects in varied subjects, for example, actions against cookies banners, enforcement action, EU-US data transfers, challenging DPA decisions, and its knowledge sharing hub – GDPRhub and GDPRtoday. It is interesting to observe the activities of one of the most active non-profit organisations in the privacy sector.
Unlawful Cookies Banners
In 2021, NOYB developed the WeComply tool to detect privacy violations of the most visited websites’ cookies banners and to allow the companies using the Consent Management Platforms which were affected by such complaints to report their compliance. According to their statistics, at least 56% of websites introduced more compliant cookie banners, and 60 cookie cases have been closed.
Enforcement Actions
In addition to the mass complaints against the unlawful cookies banners, NOYB is active in filing the complaints against other privacy infringements. In detail, they filed a complaint against Giropay – formerly known as “paydirekt” a payment service, for collecting highly sensitive user data, violating the data minimisation principle. They addressed the repeated omission of Google despite the European Court of Justice (CJEU) ruling on direct marketing email and unsolicited advertising emails without the users’ consent. Furthermore, it also revealed the alleged failure of Amazon to inform the workers about the data processing by using its warehouses’ surveillance systems to monitor workflows and assess their performance.
Challenging DPA decisions
NOYB increasingly appeals decisions of national DPA (Data Protection Authorities) and brings cases against regulators who failed to make timely progress regarding their case. Accordingly, they appealed against the Spanish DPA’s decision which was in favour of the refuse of Virgin Telco to disclose the data of clients seeking to enforce the right to access to their personal data even if the national law allows the telecommunication providers to store the metadata of its clients’ phone calls, short messages and cell tower logins. This organisation also filed several complaints against the Austrian DPA for failing to meet the deadline of the decision making process. Also, they received a favourable decision of Swedish administrative court ruling that the complainant under article 77 GDPR has the right to request a decision from the Swedish DPA (IMY) after six months in relation to their complaints against Spotify for not responding properly to an access request.
GDPRhub and GDPRtoday
In the long run, NOYB created the databases of free and open access national sources across Europe for DPA and court decisions. They also integrate a knowledge section listing commentaries on GDPR articles and DPA profiles. You can find the link to GDPRhub here.
Sources:
Report 2022: Annual_Report_2022_EN.pdf (noyb.eu)
Press release: Annual Report 2022 out now! (noyb.eu)More news about data on AstraIA Gear https://www.astraiagear.com/category/data/ and more short news, follow our LinkedIn Page. To have further discussion – follow me on Linkedin, cheers!