Noyb wins GDPR case against Youtube

Austrian digital rights ngo, noyb, has won a case against YouTube after a five-and-a-half-year battle, with the Austrian data protection authority ordering the platform to fully comply with a user’s data access request under Article 15 of the GDPR.

In 2019, privacy group noyb filed eight complaints against major streaming platforms, including YouTube, Spotify, Netflix, Amazon, and Apple Music, for not fully complying with the EU’s data protection law, the GDPR.

Under Article 15 of the GDPR, companies must provide users access to their personal data and explain how it is used, who it’s shared with, and how long it’s stored. But according to noyb, none of the companies responded appropriately.

The case against YouTube, owned by Google, stood out. A user requested their data in 2019 but received only part of it, with important details missing, such as why the data was being processed and who else had access to it.

It took the Austrian data protection authority (DSB) five and a half years to issue a ruling, finally ordering Google to hand over the complete information.

Martin Baumann, a lawyer at noyb, said these delays make it nearly impossible for users to exercise other rights, like correcting or deleting their data. The DSB confirmed that companies must fully answer access requests in a clear, easy-to-understand format.

Simply directing users to tools or privacy policies isn’t enough. Google has four weeks to comply, or it can appeal and continue delaying.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!