Netflix faces €4.75M blow for secretly tracking user data

A Dutch watchdog is imposing a fine on the streaming service for failing to inform users what it does with their data.

Five years after a complaint against the streaming service giant was filed, the Dutch Data Protection Authority (DPA) has decided to impose a fine.

According to the complaint, Netflix did not give customers sufficient or clear information about what the company did with their personal data between 2018 and 2020.

Netflix gathers a wide range of personal data from its customers, including email addresses, phone numbers, payment information, viewing habits, and the exact times customers use the platform.

“A company like that, with a turnover of billions and millions of customers worldwide, has to explain properly to its customers how it handles their personal data,” Dutch DPA chairman Aleid Wolfsen said.

“That must be crystal clear. Especially if the customer asks about this. And that was not in order.”

The company did not provide clear information on several critical aspects of its data practices. It failed to explain the purposes and legal basis for collecting and using personal data, as well as what personal data is shared with other parties and the reasons for doing so.

Also, Netflix did not clarify how long it retains users' data or how it ensures the safety of personal information when transmitting it to countries outside of Europe. Failing to inform users about their data usage violates Article 15 of the General Data Protection Regulation (GDPR).

The Dutch DPA started this investigation following complaints from the Austrian data privacy NGO noyb. In January 2019, noyb filed eight complaints against streaming providers such as Amazon, Apple Music, Spotify, YouTube, and Netflix.

The complaints were submitted to the Austrian data protection authority and forwarded to the Dutch DPA because Netflix's main European establishment is in the Netherlands.“We are happy with the DPA’s decision to issue a fine against Netflix. However, it took almost five years to obtain it, and in a very simple case," said Stefano Rossetti, data protection lawyer at noyb.

Netflix has since revised its privacy statement and enhanced the way it provides information.