noyb files eight strategic complaints on “right to access”

A test by EDRi member noyb, a European non-profit organisation for privacy enforcement, shows structural violations of most streaming services. In more than ten test cases noyb was able to identify violations of Article 15 of the General Data Protection Regulation (GDPR) in many shapes and forms by companies like Amazon, Apple, DAZN, Spotify or Netflix. On 18 January 2019, noyb filed a wave of ten strategic complaints against eight companies.

Under the new GDPR, users enjoy a “right to access”. Users are granted a right to get a copy of all raw data that a company holds about them, as well as additional information about the sources and recipients of the data, the purpose for which the data is processed or information about the countries in which the data is stored and how long it’s stored. This “right to access” is enshrined in Article 15 of the GDPR and Article 8(2) of the Charter of Fundamental Rights of the European Union.

noyb put eight online streaming services from eight countries to the test – but no service fully complied. In eight out of eight cases, noyb filed formal complaints with the relevant data protection authorities.

All major providers even engaged in ‘structural violation’ of the law

 said Max Schrems, Director of noyb.

While many smaller companies manually respond to GDPR requests, larger services like YouTube, Apple, Spotify or Amazon have built automated systems that claim to provide the relevant information. When tested, none of these systems provided the user with all relevant data.

“Many services set up automated systems to respond to access requests, but they often don’t even remotely provide the data to which every user has a right. In most cases, users only got the raw data, but, for example, no information about who this data was shared with. This leads to structural violations of users’ rights, as these systems are built to withhold the relevant information,” said Schrems.

While all other streaming services have provided some response to the request of users to access their data at least, the United Kingdom sports streaming service DAZN and the German music streaming service SoundCloud simply ignored the request . However, the responses received were lacking background information, such as the sources and recipients of data or on how long data is actually stored (“retention period”). In many cases, the raw data was provided in cryptic formats that made it extremely hard or even impossible for an average user to understand the information. In many cases certain types of raw data were also missing.

noyb has filed complaints with the Austrian Data Protection Authority (dsb.gv.at) against eight companies, on behalf of ten users. The Austrian authority will have to cooperate with the relevant authorities at the main establishment of each streaming service. As GDPR foresees 20 million euro or 4% of the worldwide turnover as a penalty, the theoretical maximum penalty across the ten complaints could be 18,8 billion euro.

The right to access is a cornerstone of the data protection framework. Only when users can get an idea of how and why their data is stored or shared, they can realistically uncover violations of GDPR and consequently take action. Every user has the right to get a copy of his or her data and to receive additional information. Usually users can fill out a form or send an email to most services. noyb has collected the links and forms for major streaming services on its webpage for everyone to use.

Article 80 of the GDPR foresees that data subjects can be represented by a non-profit association, as individual users are usually unable to file the relevant legal complaints. In this case all ten users are represented by the non-profit organisation noyb.

“noyb is meant to reasonably enforce the new rules, so that the benefits actually reach the users,” Schrems said.

noyb.eu is funded by over 3100 individual supporting members and sponsors. In order to finance the fight against data breaches in the long term, the association is looking for more supporting members. “In 1995 the EU already passed data protection laws, but they were simply ignored by the big players. We now have to make sure this does not happen again with GDPR – so far many companies only seem to be superficially compliant,” said Schrems.

noyb
https://noyb.eu/

Press release: Structural Violation of “Right to Access” and GDPR Complaints against Netflix, Amazon, Spotify, YouTube and Apple filed (18.01.2019)
https://noyb.eu/wp-content/uploads/2019/01/PA_st_EN.pdf

Netflix, Spotify & YouTube: Eight Strategic Complaints filed on “Right to Access” (18.01.2019)
https://noyb.eu/access_streaming/

(Contribution by EDRi member noyb, Austria)