YouTube Ordered to Comply with EU Data Access Rules
The Austrian data protection authority has mandated YouTube to grant users access to their personal data, enforcing data access rights stipulated in the EU’s General Data Protection Regulation (GDPR), reports 24brussels.
This ruling, announced on Friday, stems from a complaint lodged in 2019 by the privacy advocacy group Noyb, which targeted eight companies, including Netflix, AppleMusic, Amazon, and Spotify, alleging their non-compliance with GDPR data access requests.
The GDPR entitles individuals to request and receive a copy of their personal data. However, the privacy authority discovered that YouTube failed to provide comprehensive information upon request.
Noyb hailed this decision as a victory but criticized the protracted timeline, noting that it took five years for the Austrian data protection authority (DSB) to “finally” address what it described as a straightforward case.
The statement from Noyb also criticized Google, YouTube’s parent company, for prolonging the process by claiming that Irish authorities should manage the issue.
This year, the European Parliament and Council settled on new legislation aimed at expediting GDPR enforcement in cross-border cases. However, Noyb has voiced strong disapproval of the final legislative text, which has yet to officially become law.
“If it takes more than five years to receive [data] access, it becomes impossible to exercise other data subject rights,” remarked Martin Baumann, Noyb’s Data Protection Lawyer.
It remains unclear why YouTube has not faced penalties for breaching GDPR data access rights, prompting inquiries to Austria’s DSB and Google for clarification.
