noyb has achieved a win against YouTube, the video platform provided by Google. After five and a half years, the Austrian data protection authority (DSB) has finally issued a decision siding with noyb – and ordering YouTube to comply with the complainant’s access request in accordance to Article 15 GDPR. Until now, the company withheld a large amount of data, including information about the purpose of the processing, storage periods, data recipients and the tracking cookies used.
Eight complaints, no company fully complied. In January 2019, noyb filed eight complaints against a series of streaming providers such as Amazon, Apple Music, Spotify, Netflix – and of course YouTube. All of these companies failed to adequately respond to users’ access requests under Article 15 GDPR in one way or another. According to the right of access, companies are obliged to provide users with a copy of their personal data, as well as additional information about the processing, such as details on the sources and recipients of the data, the purpose for which the data is processed and the retention period.
Martin Baumann, Data Protection Lawyer at noyb: “It is absurd that a multi-billion-dollar tech company like Google rather engages in lengthy legal proceedings than to grant a user access to his personal data. Even though the authority found a violation after several years, Google successfully delayed compliance with an access request for more than half a decade. This not only creates significant costs for donation-funded NGOs such as noyb, it also robs data subjects of their fundamental rights.”
Five and a halve years for a clear-cut case. The case against YouTube (and therefore against Google) was simple and should have been easy to decide. The company had only provided a fraction of the data that it processes about the complainant and withheld information about the purpose of the processing, storage periods, data recipients and tracking cookies used. It still took the Austrian data protection authority (DSB) five and a halve years to finally issue a decision – and order Google to give the complainant full access to his data.
Multiple attempts to delay the procedure. Being well aware of enforcement deficits in Ireland, Google (ultimately unsuccessfully) tried to argue that the Irish supervisory authority is competent to handle this case. This alone massively dragged out the case. In addition, Google claimed that the complainant’s access request was not precise enough, even though he had specifically listed the data he wanted to receive and there is no such obligation to specify an access request.
Martin Baumann, Data Protection Lawyer at noyb: “Making an access request should enable data subjects to exercise other rights, such as the right to erasure or rectification by providing them with information to assess the lawfulness of processing activity. If it takes more than 5 years to receive access, it becomes impossible to exercise other data subject rights.”
Access requests must be answered in full. This decision has implications for users of other platforms as well. In its decision, the DSB once again made clear that companies must answer access requests in full and in an easily accessible form. Google unlawfully referred the complainant to several online tools to download his data, as well as YouTube’s privacy policy, which obviously does not contain personalised information about the data that is processed about him. Google now has four weeks to comply with the decision but also has the option appeal it – and further prolong a lawful response to the data subject’s access request.
Martin Baumann, Data Protection Lawyer at noyb: “Controllers should not follow Google’s example when it comes to providing users access to their data. Non-compliance with an access request can lead to fines as well as to damage claims by data subjects.”
