Back in January 2019, Austrian privacy group, None of Your Business (Noyb) filed eight strategic complaints against a bunch of streaming services. The list included Netflix, Spotify, and YouTube, which were all accused of failing to comply with the "right to access" guaranteed under Article 15 of the GDPR.
This rule gives every EU citizen the right to get a copy of their personal data and additional information about how a company uses it. When Noyb investigated, it found that some companies with automated systems provided incomplete data, while others, like SoundCloud, outright ignored the requests.
Now, after five and a half years, Noyb can celebrate as the Austrian data protection authority (DSB) has finally ruled against YouTube. According to Martin Baumann, Data Protection Lawyer at Noyb, the whole situation "is absurd". He also pointed a finger at Google for deliberately dragging out the legal proceedings instead of just giving a user their data.
The decision made by the Austrian DPA is in German, but the gist of it is a complete smackdown of Google"s approach to data access. The authority specifically criticized the company"s "portal" system, which basically forced the user to become a digital detective.
Google"s own emails told the complainant to assemble their data from various self-service tools like Google Account, My Activity, and Google Dashboard. The process often ends with using Google Takeout to download files in formats like JSON, which are unreadable to most people. The DSB clarified that this practice illegally shifts the burden of work from the company to the user and fails to provide a complete, intelligible copy of personal data as the law requires.
Noyb alleges that Google originally wanted its case to be handled in Ireland because it knew the regulatory environment there was infamously slow (and lax). The Irish Data Protection Commission (DPC) has faced severe criticism for its inaction in the past. Noyb founder Max Schrems has even accused the DPC of having an "extremely poor understanding of the material law provisions of GDPR".
Being well aware of enforcement deficits in Ireland, Google (ultimately unsuccessfully) tried to argue that the Irish supervisory authority is competent to handle this case. This alone massively dragged out the case
YouTube now has four weeks to provide a complete and understandable copy of the user"s data. Google has the option to appeal the decision.