[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9mDW38hQt15OEnnWlRMgmtT2reQt3zbCLO_Yo299oOw":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":103},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"9801f214-2dde-4372-bd2c-dfa93b063705","DSB (Austria) - 2025-0.626.844","dsb-austria-2025-0-626-844-5f6918","Fixed for redirect to correct file number Show changes","The Austrian Data Protection Authority (DSB) upheld a complaint against Google LLC concerning an access request for YouTube data. The data subject, represented by noyb, argued that Google did not provide a complete copy of their personal data, offering only limited information through a download portal that excluded data processed via cookies or Facebook pixels. The DSB ordered Google to provide the data subject with a full copy of their personal data.","Austrian DPA upholds complaint against Google LLC regarding YouTube data access request.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_2025-0.626.844&diff=53353&oldid=53283","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F1\u002F1f\u002FLogoAT.png","2026-10-09T11:23:33+00:00","2026-10-09T12:00:17.620821+00:00",7,[17,20],{"name":18,"type":19},"Google LLC","vendor",{"name":21,"type":22},"YouTube","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":26,"slug":27},null,"GDPR","gdpr",[29,31,36,41],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":96},[50,79],{"slug":51,"name":52,"problem":53,"products":54},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":80,"name":81,"problem":82,"products":83},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[84,90],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":85,"product_name":86,"url":88,"description":89},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":91,"product_name":92,"url":94,"description":95},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[97],{"slug":98,"name":99,"logo_path":100,"roles":101},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[102],"affected",{"slug":104,"title":105,"body":106,"framework_refs":107,"framework_notes":116},"google-ordered-to-provide-complete-data-copy-after-incomplete-gdpr-access-request","Google Ordered to Provide Complete Data Copy After Incomplete GDPR Access Request","Google failed to fulfill a GDPR Article 15 data subject access request (DSAR) in its entirety, omitting personal data processed through cookies and third-party tracking pixels such as Facebook Pixel. This case highlights that organizations cannot selectively disclose only the data held in primary systems while ignoring data collected through behavioral tracking and third-party integrations. Incomplete DSARs are not merely a compliance oversight — they actively undermine individuals' rights to transparency and control over their personal data. Regulators are increasingly scrutinizing the completeness of data disclosures, and organizations that rely on self-service download portals must ensure those portals capture all personal data across every processing activity.",[108,109,110,111,112,113,114,115],"GDPR Article 15 (Right of Access)","GDPR Article 30 (Records of Processing Activities)","GDPR Article 37-39 (Data Protection Officer)","NIST Privacy Framework PR.DS-P1","NIST SP 800-53 IP-1 (Individual Access)","CIS Control 3: Data Protection","ISO\u002FIEC 27701:2019 Section 7.3 (Rights of Data Subjects)","ITIL Service Design – Information Security Management",{}]