Data protection

Netflix: million-euro fine after Schrems complaint

Netflix had not sufficiently informed users about the use of their data.

(Bild: All rights reserved - Ruggiero Scardigno © copyright)

According to a decision by the Dutch Data Protection Authority, Netflix must pay a fine of 4.75 million euros almost five years after a complaint was filed by Max Schrems' data protection organization noyb. The reason for this is that the US streaming provider allegedly did not adequately inform its customers about the use of their data.

However, the case is not yet completely closed, the NGO also announced on Wednesday. Netflix has appealed against the penalty to the data protection authority, but not against the decision as a whole. In the meantime, noyb is still waiting for a decision from the Austrian Data Protection Authority (DSB) in the same case against the streaming provider.

Criticism of the length of the proceedings
noyb data protection lawyer Stefano Rossetti was pleased with the decision of the Dutch authority, which "sided with noyb on many points of the complaint". At the same time, he criticized the length of the proceedings. "This is actually a very simple case," said Rossetti, who added that it is currently being examined "whether the decision takes into account all the points raised in our complaint".

The NGO emphasized that while the Dutch decision highlights a number of important problems regarding Netflix's handling of requests for information, it also leaves out one important point: "Netflix has not only failed to provide sufficient information about why it collects data and what it does with it. The company has not even managed to provide the complainant with a full copy of the data," the noyb press release continued.

The data protection NGO noyb filed eight complaints against a number of streaming providers in January 2019.

(Bild: APA/HANS PUNZ)

A total of eight complaints filed
In January 2019, the Viennese lawyer's NGO filed a total of eight complaints against a number of streaming providers, including Amazon, Apple Music, Spotify, YouTube and Netflix. According to noyb, all of these companies "failed in one way or another to respond appropriately to requests for information (Article 15 GDPR)".

"The right of access enshrined in the GDPR obliges companies to provide their users with a copy of all raw data stored about them. They must also provide additional information about the sources and recipients of the data, the purpose of the data processing or information about the countries in which the data is stored. They must also provide information about the storage period," noyb informed.