[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEcff_eRWNaCkHO2iyGfOILTIjrTANKKh2lP6fedBdvE":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"0241074d-2f0c-4f38-be0a-493d0673ca00","DSB (Austria) - 2025-0.626.844","dsb-austria-2025-0-626-844-3942b8","← Older revision Revision as of 08:26, 2 October 2026 Line 93: Line 93: === Facts === === Facts === The data subject requested access to their personal data from a video streaming service (controller) established in the US. The controller provided access to certain personal data in “opml” and “json” format. The controller’s reply did not include information on personal data from tracking, cookies, web profile, purposes of processing, recipients, storage periods, data subjects’ rights, right to lodge a complaint with the supervisory authority, sources of personal data and data transfers to third countries. The data subject requested access to their personal data from a video streaming service (controller) established in the US. The controller provided access to certain personal data in “opml” and “json” format. The controller’s reply did not include information on personal data from tracking, cookies, web profile, purposes of processing, recipients, storage periods, data subjects’ rights, right to lodge a complaint with the supervisory authority, sources of personal data and data transfers to third countries. For further information, the controller referred the data subject to general information on their privacy statement and to different online tools provided by the controller on a portal. There was no single tool where the data subject could download all requested data. The controller indicated that the data subject shall contact customer service in case they cannot access all the requested personal data on the tools. For further information, the controller referred the data subject to general information on their privacy statement and to different online tools provided by the controller on a portal. There was no single tool where the data subject could download all requested data. The controller indicated that the data subject shall contact customer service in case they cannot access all the requested personal data on the tools. The data subject lodged a complaint with the DPA, claiming a violation of their access right. The data subject lodged a complaint with the DPA, claiming a violation of their access right. Line 101: Line 104: === Holding === === Holding === The DPA held that the GDPR was applicable pursuant to [[Article 3 GDPR|Article 3(2)(a) GDPR]] because the controller, despite being established outside the EU, offered their services within the EU. The DPA held that the GDPR was applicable pursuant to [[Article 3 GDPR|Article 3(2)(a) GDPR]] because the controller, despite being established outside the EU, offered their services within the EU. By providing the personal data in “opml” and “json” format, the controller violated the principle of transparency provided for in [[Article 12 GDPR|Article 12(1) GDPR]]. This is because these formats are used for machine processing and are not easily accessible and intelligible for the data subject. The right to access does not only encompass the mere access to the data, but also the preparation thereof in an intelligible and accessible format that data subjects who are not specialised in IT can understand. By providing the personal data in “opml” and “json” format, the controller violated the principle of transparency provided for in [[Article 12 GDPR|Article 12(1) GDPR]]. This is because these formats are used for machine processing and are not easily accessible and intelligible for the data subject. The right to access does not only encompass the mere access to the data, but also the preparation thereof in an intelligible and accessible format that data subjects who are not specialised in IT can understand. In order for the controller to comply with [[Article 12 GDPR|Article 12 GDPR]] and [[Article 15 GDPR|Article 15 GDPR]], the controller must give full access to the data. A portal where the data subject must rely on several tools in order to receive access to their personal data, and to request from customer service any information that is not provided via the tools, does not fulfil this criterium. The data subject cannot be expected to identify any missing information since the data subject does not know what personal data the controller processes. It is the purpose of the access right to provide the data subject with the knowledge about the data that the controller processes about them. The controller did not comply with [[Article 15 GDPR|Article 15 GDPR]] by referring the data subject to the privacy statement. The privacy statement includes ex ante information in order to fulfil the obligations of [[Article 13 GDPR|Article 13 GDPR]] and [[Article 14 GDPR|Article 14 GDPR]]. The general information on the processing of the controller is not necessarily applicable to the individual case of the data subject. The controller cannot fulfil its obligation to give access by providing general information. In order for the controller to comply with [[Article 12 GDPR]] and [[Article 15 GDPR]], the controller must give full access to the data. A portal where the data subject must rely on several tools in order to receive access to their personal data, and to request from customer service any information that is not provided via the tools, does not fulfil this criterium. The data subject cannot be expected to identify any missing information since the data subject does not know what personal data the controller processes. It is the purpose of the access right to provide the data subject with the knowledge about the data that the controller processes about them. The controller did not comply with [[Article 15 GDPR]] by referring the data subject to the privacy statement. The privacy statement includes ex ante information in order to fulfil the obligations of [[Article 13 GDPR]] and [[Article 14 GDPR]]. The general information on the processing of the controller is not necessarily applicable to the individual case of the data subject. The controller cannot fulfil its obligation to give access by providing general information. As far as the purposes of processing are concerned, the DPA held that the controller must provide information on the specific purposes of processing for the specific case of the data subject in order to comply with [[Article 15 GDPR|Article 15(1)(a) GDPR]]. The data subject must be able to identify which categories of personal data about them are processed for what purpose. The same is true for the storage period. Therefore, the DPA found a violation of [[Article 15 GDPR|Article 15(1)(a) GDPR]] and [[Article 15 GDPR|Article 15(1)(d) GDPR]]. As far as the purposes of processing are concerned, the DPA held that the controller must provide information on the specific purposes of processing for the specific case of the data subject in order to comply with [[Article 15 GDPR|Article 15(1)(a) GDPR]]. The data subject must be able to identify which categories of personal data about them are processed for what purpose. The same is true for the storage period. Therefore, the DPA found a violation of [[Article 15 GDPR|Article 15(1)(a) GDPR]] and [[Article 15 GDPR|Article 15(1)(d) GDPR]]. As far as the sources of data, the recipients, and appropriate safeguards for data transfers to third countries are concerned, the DPA held that the referral to the general information in the privacy statement did not suffice either. The privacy statement merely included general remarks such as the possible categories of data, the fact that the data can be collected from specific sources and that a certain legal framework in the light of data transfers to third countries is followed. Therefore, the controller violated [[Article 15 GDPR|Article 15(1) GDPR]] and [[Article 15 GDPR|Article 15(2) GDPR]]. As far as the sources of data, the recipients, and appropriate safeguards for data transfers to third countries are concerned, the DPA held that the referral to the general information in the privacy statement did not suffice either. The privacy statement merely included general remarks such as the possible categories of data, the fact that the data can be collected from specific sources and that a certain legal framework in the light of data transfers to third countries is followed. Therefore, the controller violated [[Article 15 GDPR|Article 15(1) GDPR]] and [[Article 15 GDPR|Article 15(2) GDPR]] Because of the economic size of the controller, a globally acting cooperation, the provision of the requested information can be expected from the controller. Because of the economic size of the controller, a globally acting cooperation, the provision of the requested information can be expected from the controller.","Austria's Data Protection Authority (DSB) ruled that the GDPR applies to a US-based video streaming service that offers services within the EU. The DSB found the service violated transparency principles by providing personal data in machine-readable formats (OPML, JSON) and failing to provide comprehensive information on data processing, storage, and transfers. The DPA emphasized that data access must be in an intelligible format and that general privacy statements are insufficient to meet GDPR requirements.","Austria's DPA rules GDPR applies to US-based video streaming service for EU users.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_2025-0.626.844&diff=53283&oldid=53282","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F1\u002F1f\u002FLogoAT.png","2026-10-02T08:26:55+00:00","2026-10-02T10:00:19.548949+00:00",7,[17,20],{"name":18,"type":19},"DSB","vendor",{"name":21,"type":22},"video streaming service","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":68},"austria-dsb-rules-us-streaming-service-violated-gdpr-transparency-requirements","Austria DSB Rules US Streaming Service Violated GDPR Transparency Requirements","Austria's Data Protection Authority found that a US-based video streaming service failed to meet GDPR transparency obligations by delivering personal data in raw machine-readable formats (OPML, JSON) without human-intelligible context. The root issue is a fundamental misunderstanding — or deliberate minimization — of what 'data access' means under GDPR: it must be clear, structured for comprehension, and accompanied by full details on processing purposes, storage durations, and cross-border transfers. Providing a generic privacy policy does not satisfy the specific, individualised transparency requirements of Articles 13, 14, and 15 of the GDPR. This ruling reinforces that geographic location does not exempt organisations from GDPR obligations when they actively offer services to EU residents. Organisations that treat compliance as a checkbox risk regulatory action, reputational harm, and eroding user trust.",[56,57,58,59,60,61,62,63,64,65,66,67],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 12 – Transparent information and communication","GDPR Article 13 – Information to be provided where personal data are collected","GDPR Article 14 – Information where personal data have not been obtained from the data subject","GDPR Article 15 – Right of access by the data subject","GDPR Article 44-49 – Transfers of personal data to third countries","NIST Privacy Framework PR.PO-P1 – Policies and procedures for privacy practices","NIST SP 800-53 IP-1 – Consent","NIST SP 800-53 IP-2 – Individual Access","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Management – Compliance and governance processes",{}]