noyb has achieved a win against Netflix. Almost five years after the complaint has been filed, the Dutch data protection authority (DPA) has finally issued a decision. The authority is imposing a fine of €4.75 million against the streaming provider because it failed to adequately inform customers about what it does with their data.
Eight complaints, no company fully complied. In January 2019, noyb filed eight complaints against a series of streaming providers such as Amazon, Apple Music, Spotify, YouTube – and of course Netflix. All of these companies failed to adequately respond to users’ access requests under Article 15 GDPR in one way or another. According to the right of access, companies are obliged to grant their users access to a copy of all raw data that it about the user, as well as additional information about the sources and recipients of the data, the purpose for which the data is processed or information about the countries in which the data is stored and how long it is stored.
Stefano Rossetti, data protection lawyer at noyb: “We are happy with the DPA’s decision to issue a fine against Netflix. However, it took almost five years to obtain it, and in a very simple case."
Dutch DPA sides with noyb. The Dutch data protection authority has now sided with noyb and found that Netflix didn’t provide its customers clear enough information about what it exactly does with their data. While the decision highlights a number of important issues with Netflix’s handling of access requests, it unfortunately leaves out one important point that was mentioned in noyb’s complaint: Netflix didn’t just fail to provide sufficient information about why it collects data and what it does with it. The company didn’t even manage to provide a full copy of the complainant’s data.
Stefano Rossetti, data protection lawyer at noyb: "The Dutch authority sides with noyb on many points of the complaint. At the moment, we are assessing if the decision considers all elements raised in our complaint."
The case isn’t over. According to the DPA, Netflix has already objected to the fine, but hasn’t yet appealed the decision as a whole. In the meantime, noyb is still waiting for a decision from the Austrian data protection authority (DSB) in the same case against Netflix.
