Five years later sounds like a half-baked sequel to a well-known zombie flick franchise. But it’s a reference to how long it’s taken a data access complaint against Netflix to deliver a penalty decision in the European Union.
The fine that’s — finally — been issued under the bloc’s General Data Protection Regulation (GDPR) is for €4.75 million ($5 million at current exchange rates). Netflix, meanwhile, raked in around $33.7 billion in annual revenue in 2023 alone.
The Dutch data protection authority (DPA) concluded that the streaming giant failed to adequately inform customers what it does with their data, which runs counter to GDPR data access rights. EU citizens are supposed to be able to do things like ask for a copy of their info and how it’s being used.
This plodding enforcement (and its underwhelming finale) underscores the challenges of turning individual rights into enforcement that holds power to account. Netflix has also objected to the penalty, and may seek to appeal, so this decision might not be the final word, either.
noyb, the privacy rights non-profit behind the Netflix complaint, filed multiple complaints simultaneously, targeting other streaming platforms over data access issues, including Amazon Prime, Apple Music, and YouTube — most of which remain undecided.
“Almost all complaints are still pending, except for Flimmit in Austria and for Spotify where we won last year after taking the DPA to court for inactivity,” noyb told us. “Apart from that, our case against Apple Music is moving forward in Ireland and we took the Luxembourg DPA to court for inactivity (Amazon).”