NGO acheives legal victory over YouTube after 5.5 years on issue of access to user data

What is a completely normal process has been stretched out over years: Some years ago, data protection organization noyb submitted an "access request" for personal data to major streaming providers such as Amazon, Apple Music, Spotify, Netflix, and YouTube. According to GDPR (Article 15), companies are "obliged to provide users with a copy of their personal data, as well as additional information about the processing, such as details on the sources and recipients of the data, the purpose for which the data is processed and the retention period".

However, all companies contacted were unable (or unwilling?) to comply with these requests. Subsequently, in January 2019, noyb filed a complaint against a total of eight companies, including Apple, Amazon, Google and others, with the Austrian Data Protection Authority (DSB). But only now, more than five years later, has a decision been made: The DSB has ruled in noyb's favor.

In the half-decade since then, Google has repeatedly found ways to delay this essentially simple process. Among other things, the company attempted to transfer the proceedings to Ireland where, according to noyb, data protection enforcement has known deficiencies. Noyb has expressed incomprehension that a multi-billion dollar company would rather pursue a lengthy legal process than guarantee users their right to information.

Such lengthy proceedings not only cost NGOs like noyb a great deal of money, but they also deprive those affected of their fundamental rights. Private individuals have little recourse against such practices. In cases of doubt, they are forced to waive their fundamental rights or wait many years for their enforcement, assuming they are willing to pursue a lengthy and costly legal process against a billion-dollar empire.

If Google does not appeal, it must comply with the request for information in full. Whether the proceedings will also result in a fine is not mentioned in the noyb report and is thus doubtful. At the very least, Google will likely have to bear the legal costs of the defeat.