DSB (Austria) - 2025-0.626.844
Austria's DPA rules GDPR applies to US-based video streaming service for EU users.
Austria's Data Protection Authority (DSB) ruled that the GDPR applies to a US-based video streaming service that offers services within the EU. The DSB found the service violated transparency principles by providing personal data in machine-readable formats (OPML, JSON) and failing to provide comprehensive information on data processing, storage, and transfers. The DPA emphasized that data access must be in an intelligible format and that general privacy statements are insufficient to meet GDPR requirements.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DSB?
Get an email when a new story names DSB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAustria's Data Protection Authority found that a US-based video streaming service failed to meet GDPR transparency obligations by delivering personal data in raw machine-readable formats (OPML, JSON) without human-intelligible context. The root issue is a fundamental misunderstanding — or deliberate minimization — of what 'data access' means under GDPR: it must be clear, structured for comprehension, and accompanied by full details on processing purposes, storage durations, and cross-border transfers. Providing a generic privacy policy does not satisfy the specific, individualised transparency requirements of Articles 13, 14, and 15 of the GDPR. This ruling reinforces that geographic location does not exempt organisations from GDPR obligations when they actively offer services to EU residents. Organisations that treat compliance as a checkbox risk regulatory action, reputational harm, and eroding user trust.