Victim: Netflix | Netflix
Price: €4.75 Million
Exfiltrated Data Type: Personal Data
Key Points :
- Netflix was fined for failing to provide clear information about personal data usage.
- The investigation was initiated in 2019 after complaints from the NGO None of Your Business (noyb).
- Between 2018 and 2020, Netflix did not meet GDPR requirements regarding user data transparency.
- Key areas lacking transparency included data collection purposes, sharing practices, retention periods, and security measures.
- Netflix has updated its privacy statement following the investigation.
- Despite objections, the Dutch DPA maintains the fine is justified.
Streaming giant Netflix has been hit with a hefty fine by the Dutch Data Protection Authority (Dutch DPA) for failing to provide clear and sufficient information to customers about how their personal data is used.
The Dutch DPA launched an investigation in 2019 following complaints from Austrian privacy NGO, None of your business (noyb). The investigation revealed that between 2018 and 2020, Netflix fell short of GDPR requirements by failing to adequately inform users about its data practices.
“A company like that, with a turnover of billions and millions of customers worldwide, has to explain properly to its customers how it handles their personal data,” stated Dutch DPA chairman Aleid Wolfsen. “That must be crystal clear. Especially if the customer asks about this. And that was not in order.”
Netflix collects a wide range of personal data, from basic contact information to viewing habits and preferences. However, the company was found to be lacking in transparency regarding several key areas:
- The purposes and legal basis for data collection and use.
- Data sharing practices with third parties.
- Data retention periods.
- Security measures for data transfers outside Europe.
“On several points, Netflix provided too little information to customers, or the information provided was unclear,” the Dutch DPA concluded.
Although Netflix has since updated its privacy statement and improved its information provision, the Dutch DPA imposed a fine of €4.75 million.
Netflix has objected to the fine, but the Dutch DPA, in coordination with other European data protection authorities, maintains that the penalty is justified.
Related Posts:
Original Source: https://securityonline.info/netflix-fined-e4-75-million-for-failing-to-explain-how-it-handles-user-data/