How to request your data from streaming services

On this page we have collected instructions to request your personal information from a number of larger streaming services under Article 15 GDPR.

AmazonPrime

How to request your information from AmazonPrime:

  1. Copy this link https://www.amazon.de/gp/css/contact-us-access and log in to your Prime Account
  2. Under “ What can we help you with?” choose “Prime and more
  3. Under “ Tell us more about your issue” select “Request your data” for “Select an issue
  4. Select “Request data file be sent at a later date” for “Select Issue details
  5. Select “Request all categories of data” for “Select additional details
  6. Under “ How would you like to contact us?” choose “E-mail
  7. You will then be redirected to another final screen. In the text box, please enter the following text: “I, name surname, hereby request all information I am entitled to under Article 15 GDPR”. (According to Prime you have to enter your name to confirm the data request.)
  8. Press “send e-mail”.

Our experience:

We got an email with a download link that lead to a ZIP file, but most additional information (like sources, recipients, purpose of processing) was missing. If you have a different experience with AmazonPrime, let us know!

 

Apple Music

How to request your information from Apple:

  1. Click here to get to their online privacy inquiry form
  2. Under the “Choose a location” section, choose “Europe”;
  3. Choose your country or region;
  4. Fill the region, first and last name
  5. Enter the e-mail of your Apple account
  6. As subject, type “Access under Article 15 GDPR
  7. As text copy/paste “I hereby request all information I am entitled to under Article 15 GDPR.”
  8. Press submit

Our experience:

We got an email with a download link with a number of files, but most additional information (like sources, recipients, purpose of processing) was missing. If you have a different experience with Apple, let us know!

DAZN

How to request your information from DAZN:

  1. Send an e-mail to help@dazn.com
  2. Please make sure to send the e-mail from the e-mail address that is associated with your account
  3. In the subject line copy and paste: “Right to Access under Art 15 GDPR
  4. In the body of your e-mail please copy and paste this text: “I hereby request all information I am entitled to under Article 15 GDPR that is associated with my account. If you have any further questions do not hesitate to contact me.”
  5. It is likely that they might get back to you requesting further proof for identity verification. For further information on this issue, see the FAQs below

    Our experience:

    We got a confirmation email, but no response from DAZN. If you have a different experience with DAZN, let us know

Netflix

How to request your information from Netflix:

  1. Send an e-mail to privacy@netflix.com
  2. Please make sure to send the e-mail from the e-mail address that is associated with your account
  3. In the subject line copy and paste: “Right to Access under Art 15 GDPR
  4. In the body of your e-mail please copy and paste this text: “I hereby request all information I am entitled to under Article 15 GDPR that is associated with my account. If you have any further questions do not hesitate to contact me.”
  5. It is likely that they might get back to you requesting further proof for identity verification. For further information on this issue, see the FAQs below

    Our experience:

    We got an email with a lengthy PDF file (71 and 166 pages). If you have another experience with Netflix, let us know!

SoundCloud

How to request your information from SoundCloud:

  1. Send an e-mail to dataprotection@soundcloud.com
  2. Please make sure to send the e-mail from the e-mail address that is associated with your account
  3. In the subject line copy and paste: “Right to Access under Art 15 GDPR
  4. In the body of your e-mail please copy and paste this text: “I hereby request all information I am entitled to under Article 15 GDPR that is associated with my account. If you have any further questions do not hesitate to contact me.”
  5. It is likely that they might get back to you requesting further proof for identity verification. For further information on this issue, see the FAQs below.

    Our experience:

    We got a confirmation email, but no response from SoundCloud. If you have a different experience, let us know

Spotify

How to request your information from Spotify:

  1. Click here to reach their privacy contact form
  2. Click on “I want to download a copy of my data
  3. Do not download your data, but click on “I still need help
  4. Fill out the form (subscription, username, email, date of birth, ZIP and name)
  5. Under “tell us more”, copy and paste the following sentence: “I hereby request all information I am entitled to under Article 15 GDPR that is associated with my account. If you have any further questions do not hesitate to contact me.
  6. Press “Send question”

Our experience:

We got a download link via email that lead to some raw data files, but all additional information (like sources, recipients, purpose of processing) was missing. If you have a different experience, let us know!

YouTube (Google)

How to request your information from YouTube (Google):

  1. Click here to get to the Google request form
  2. Enter your e-mail address
  3. Select your country
  4. Select “other” as the Google product
  5. Copy the following text into the “What personal data are you seeking?” box:
    “I hereby request all information I am entitled to under Article 15 GDPR concerning all Google products.”
  6. Submit the form

Our experience:

We got a link that lead us to the “dashboard” where users can download a “takeout”, however most addional information (sources, recipients or purposes of processing) were not disclosed. If you have a different experiance, let us know!

Any other service

You have the right to request your data from any company under Article 15 GDPR. There is no duty to justify why you want to have your data and there is no duty to follow the format under which you can make the request. You can send an email, message or a regular mail.

How to make a request:

  1. Find a contact form or the email address
  2. Send a generic request (“I hereby request all information I am entitled to under Article 15 GDPR”)
  3. Send an identifier (for example your account-ID, name, email) that allows them to find your data
  4. Say that they should get back if they need any further information

Some Tips:

  • Use their format: We recommend to use the format that a company provides, simply because it is usually faster. However, some companies have absurd online forms, in which case we recommend an email or letter. 
  • Do not just download your data: Make sure that you do not just download your data on some webpage or in some app, but that you make a formal request under Article 15 – otherwise a company may be able to claim that you just clicked on a button, but did not exercise your Article 15 rights.
  • Be specific, but do not limit your request: You have to tell a company which data you want to get information on (like “all data associated with my account” or “all data you hold about me”), but make sure that you do not limit your request (like “I want a copy of my data”), as you have a wide range of rights under Article 15 (like knowing who they shared your data with). If you limit your request (for example by only requesting a copy) they may not give you the other information that you are entitled to under Article 15 GDPR.
FAQs
  • I have a “catch all” email address (like *@youdomain.com) and companies say they cannot identify me as my email addresses do not match. What should I do? Tell them that they should send you a test mail on the registered email address in their database with a code to proof that you are in control of that email address.
  • They say they have issues with identification or authentication of my request. What should I do? There are two separate issues: (1) If they cannot find you data (identification of the data), you may be able to provide more information like ID numbers, emails, phone numbers, cookie values or any other information that allow them to identify the data set you are concerned about. If they are unable to find your data, they do not have to respond to your request. (2) If they say that they are not sure if you really requested your own data, or that you may be some other person, they have to work with you to ensure that you are the right person. Usually that is done by using emails, login to accounts, passports or digital signatures. Ask them what they propose as a solution. They are not allowed to decline your request on the basis of missing authentication.
  • Is there a more secure way to get my data than email? Most companies have secure systems to send you your data. You can always request to get your data in a more secure form than via email. Just add a sentence about the common format (e.g. mail, PGP, common encryption) that you feel comfortable with.
  • Isn’t the right to access a security problem? So far there is more speculation about misuse than actual evidence of it. Companies have the duty to take the necessary steps to secure your data – also against illegal access requests. The level of protection has to be appropriate and “state of the art”. If the procedures are insecure, this can itself be a violation of Article 32 GDPR.
  • What is the legal basis of the “right to access”? See Article 12 and 15 GDPR for all details.

 

 

Support Us!

  • noyb 2018 funding goal 75% 75%

Follow Us!