[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPHBaCA8JEv08-eqP8EUxskk4Ro95smra9oYe7JHpQ0Y":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":56},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"134e10bd-b7e5-4baf-a457-756b1a35d151","DSB (Austria) - D130.200","dsb-austria-d130-200-0a4daa","redirect to correct file number Show changes","The Austrian Data Protection Authority (DSB) upheld a complaint against Google LLC regarding an access request for YouTube data. The complainant argued that Google provided incomplete information, excluding data processed via cookies or Facebook pixels. The DSB ruled that Google LLC was the responsible controller and ordered them to provide the data subject with a full copy of their personal data on YouTube, emphasizing the importance of the right to access.","Austrian DPA upholds complaint against Google LLC for YouTube data access.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_D130.200&diff=53354&oldid=48954",null,"2026-10-09T11:24:04+00:00","2026-10-09T12:00:17.620821+00:00",7,[17,20],{"name":18,"type":19},"Google LLC","vendor",{"name":21,"type":22},"YouTube","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":12,"name":25,"slug":26},"GDPR","gdpr",[28,30,35,40],{"category":29},{"id":23,"icon":12,"name":25,"slug":26},{"category":31},{"id":32,"icon":12,"name":33,"slug":34},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,21],{"controls":48,"vendors":49},[],[50],{"slug":51,"name":52,"logo_path":53,"roles":54},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[55],"affected",{"slug":57,"title":58,"body":59,"framework_refs":60,"framework_notes":69},"google-ordered-to-provide-full-gdpr-data-access-after-excluding-cookie-and-tracking-data","Google Ordered to Provide Full GDPR Data Access After Excluding Cookie and Tracking Data","Google failed to fulfill a complete data subject access request (DSAR) under GDPR Article 15 by omitting personal data processed through cookies and third-party tracking pixels (e.g., Facebook Pixel) on YouTube. This partial disclosure violates the fundamental right of individuals to know what personal data is held about them and how it is processed. The Austrian DSB ruling reinforces that controllers must account for all data processing activities — including those facilitated by third-party technologies embedded in their platforms — when responding to access requests. Incomplete DSARs erode user trust, expose organizations to regulatory enforcement, and signal broader gaps in data inventory and governance practices.",[61,62,63,64,65,66,67,68],"GDPR Article 15 – Right of Access by the Data Subject","GDPR Article 30 – Records of Processing Activities","GDPR Article 5(1)(a) – Principle of Transparency","GDPR Article 4(7) – Definition of Controller","NIST Privacy Framework PR.DS-P1 – Data Processing Policies","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management","ITIL Service Design – Information Security Management",{}]