DSB (Austria) - 2025-0.626.844
Austrian DPA upholds complaint against Google LLC regarding YouTube data access request.
The Austrian Data Protection Authority (DSB) upheld a complaint against Google LLC concerning an access request for YouTube data. The data subject, represented by noyb, argued that Google did not provide a complete copy of their personal data, offering only limited information through a download portal that excluded data processed via cookies or Facebook pixels. The DSB ordered Google to provide the data subject with a full copy of their personal data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google LLC?
Get an email when a new story names Google LLC, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGoogle failed to fulfill a GDPR Article 15 data subject access request (DSAR) in its entirety, omitting personal data processed through cookies and third-party tracking pixels such as Facebook Pixel. This case highlights that organizations cannot selectively disclose only the data held in primary systems while ignoring data collected through behavioral tracking and third-party integrations. Incomplete DSARs are not merely a compliance oversight — they actively undermine individuals' rights to transparency and control over their personal data. Regulators are increasingly scrutinizing the completeness of data disclosures, and organizations that rely on self-service download portals must ensure those portals capture all personal data across every processing activity.
What helps against this
How we list vendors
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.