Streaming service DAZN took almost five years to answer a simple access request
In January 2019, noyb filed two complaints against the streaming service DAZN for not responding to access requests. In theory, these sound like straightforward cases. In reality, they were not closed until September 2023 – that is, after more than 4,5 years, the involvement of the Austrian Federal Administrative Court and the exchange of numerous submissions. In the end, the court had to order DAZN to provide the missing information.
(No) right to access. Shortly after the GDPR became applicable in May 2018, noyb put the then-new privacy law’s “right of access” to the test by investigating how different streaming services would react to access requests by their users. The result was sobering: not a single company was fully GDPR compliant. Among the worst: DAZN. The service didn’t even respond to the requests filed in September 2018. This was the start of a year-long legal battle, as noyb filed complaints against all the companies with the Austrian data protection authority.
“Without undue delay”. Thanks to the “right of access” under Article 15 GDPR, users are (in theory) entitled to receive a copy of all personal data that a company holds about them, as well as additional information such as the sources and recipients of the data, the purpose of the processing, or for how long data is stored. Under Article 12 GDPR, companies must provide this information “without undue delay and in any event within one month of receipt of the request”.
Almost five years of legal wrangling. Responding to access requests should be a routine exercise for companies. The reality was different, as DAZN’s unwillingness to comply with the law was accompanied by inaction of the Austrian data protection authority (DSB). In the end, both cases against DAZN had to be referred to the Austrian Federal Administrative Court (BVwG), because the DSB didn’t bother to deal with the complaints over and over again. This allowed DAZN to ignore the access requests for years and only provide the missing information piece by piece – and after numerous submissions were exchanged between noyb and DAZN during the court proceedings.
Marco Blocher, Data Protection Lawyer at noyb: “It’s disappointing that after five years of GDPR, companies can still ignore the right of access in whole or in part. Instead of appropriate fines for ignoring an access request or providing incomplete answers, companies are given a dozen chances over years of legal proceedings. Much like speeding tickets, even small fines that are imposed with little fanfare could lead to much better compliance – and save everyone a lot of unnecessary work.”
All’s well that ends well? On 6 September 2023, the BVwG finally ruled that DAZN had gradually provided all the information requested, with the exception of the contact information of the recipients of the user data. DAZN was ordered to provide this information and eventually did so on 13 September 2023. In the end, it took almost five years and hours of work by noyb’s lawyers to uphold the users’ right of access – despite the GDPR expecting a request for access to be fulfilled within one month. The cases illustrate once more how difficult the enforcement of data protection rights is in practice. DAZN is not an isolated case. Approximately 400 of noyb's cases have been pending for more than two years.
