First decision on noyb’s streaming complaints - after more than one and a half years
In cooperation with the Austrian Chamber of Labour, noyb filed eight complaints against streaming services such as Netflix and Amazon Prime in January 2019 for not sufficiently complying with the right of access under Article 15 GDPR. A first decision has now been issued: At the beginning of September 2020 – more than one and a half years after the complaint was lodged – the Austrian data protection authority (Datenschutzbehörde – "DSB") decided on the complaint against the Vienna streaming service Flimmit. The legal deadline for decisions in Austria is six months. The DSB took its decision only after noyb filed a so-called late complaint with the court, giving the DSB three months to take a decision.
"We are pleased that one of our complaints has finally been decided. However, the fact that it took more than one and a half years and a complaint to the Austrian Federal Administrative Court is extremely disappointing in terms of the enforceability of the GDPR. The legal deadline in Austria is actually six months" Marco Blocher, data protection lawyer at noyb.eu
No substantive examination on the grounds of the complaint. On the merits of the case, the DSB rejected noyb's complaint – but not because it was unfounded. The rejection was only based on the fact that Flimmit submitted the information that was missing from the original information provided (namely, to whom the complainant's data had been transmitted) in the course of the DSB procedure. Such "ex-post compliance" by a data controller allows the DSB to close complaint procedures without having to examine whether there was a GDPR-violation. At the same time, it allows companies to comply with the GDPR only in the event of a complaint and still escape without any fine.
"In simple terms, the Austrian Data Protection Act provides that a complaint procedure must be closed if the alleged GDPR-violation is remedied in the course of the procedure. As a company – even if you have clearly violated the GDPR – you will thus receive a ‘special invitation‘ every time before actually being fined. It is as if a radar trap would invite you to slow down before a fine is imposed. Drivers would soon realise that in 99% of cases you escape basically unpunished. We doubt that this Austrian provision complies with the GDPR, which requires dissuasive penalties. Under existing law, the DSB could also impose a penalty that takes into account the company's cooperation and acknowledgement, but in our experience the DSB does not do so." Marco Blocher, data protection lawyer at noyb.eu
No decision in sight on the remaining seven complaints – ineffectiveness as the common thread. There is little progress on the other streaming complaints (against Amazon Prime, Apple Music, DAZN, Flimmit, Netflix, SoundCloud, Spotify and YouTube). In the case against DAZN, noyb has also filed a complaint due to the DSB’s inactivity with the Federal Administrative Court. In that case, the DSB was unable to make its decision within three months and has handed the case to the Federal Administrative Court. With regard to YouTube, there is disagreement as to which authority is responsible. Other procedures seem to simply have been lost, although noyb keeps following-up with the authorities. Of eight proceedings, only one has been decided after more than one and a half years.
"Despite different national procedural laws, there seems to be one thing in common: as soon as there is a connection to several EU Member States, the wheels come to a halt. Now that the GDPR has been in effect for over four and applicable for over two years, the authorities urgently need to get their cooperation up and running. At present, this is not working at all and users are being forgotten" Marco Blocher, data protection lawyer at noyb.eu
