Austrian DPA orders Google to honor complainant’s access request

The Datenschutzbehörde (DSB), Austria’s data protection authority (DPA), has ruled that YouTube’s parent company Google has to comply with a complainant’s access request by providing a complete copy of all of his personal data that’s been processed.

This case dates back to January 2019, when the Austrian privacy advocacy group noyb filed a complaint against YouTube for failing to properly respond to a complainant’s access request under Article 15 of the General Data Protection Regulation (GDPR).

This article states that companies are obliged to provide users with a copy of their personal data that has been processed, as well as any additional information about the nature of the processing.

However, YouTube, and therefore Google, only provided a fraction of the data that it had processed on the complainant. Details such as processing purposes, data retention periods, data sources, data recipients, guarantees for international data transfers, tracking cookies, and advertising profiles weren’t provided.

In addition, the information that was handed over wasn’t presented in a clear, understandable, and accessible format for the average user. According to the DSB, this is a violation of the GDPR’s transparency requirements.

The privacy supervisor has ordered Google to provide full and user-friendly data access within four weeks.

Although noyb is happy with the final verdict, it’s appalled by the fact that it took the DSB five-and-a-half years to come to a decision.

“It is absurd that a multi-billion-dollar tech company like Google rather engages in lengthy legal proceedings than to grant a user access to his personal data. Even though the authority found a violation after several years, Google successfully delayed compliance with an access request for more than half a decade,” Martin Baumann, data protection lawyer at noyb, said in a response.

“This not only creates significant costs for donation-funded NGOs such as noyb, it also robs data subjects of their fundamental rights. If it takes more than five years to receive access, it becomes impossible to exercise other data subject rights,” he continues.

Google may appeal the DPA’s ruling at the Austrian Federal Administrative Court. The search engine giant has four weeks to do so.