[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEixG8vd3DO03xIfadh6-H41lCQ11y200UqoB8Oj2ty0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":45,"controls":46},"a9f823d3-a4c8-47a4-aeb7-9881dc65eacd","austria-dsb-rules-us-streaming-service-violated-gdpr-transparency-requirements","0241074d-2f0c-4f38-be0a-493d0673ca00","Austria DSB Rules US Streaming Service Violated GDPR Transparency Requirements","Austria's Data Protection Authority found that a US-based video streaming service failed to meet GDPR transparency obligations by delivering personal data in raw machine-readable formats (OPML, JSON) without human-intelligible context. The root issue is a fundamental misunderstanding — or deliberate minimization — of what 'data access' means under GDPR: it must be clear, structured for comprehension, and accompanied by full details on processing purposes, storage durations, and cross-border transfers. Providing a generic privacy policy does not satisfy the specific, individualised transparency requirements of Articles 13, 14, and 15 of the GDPR. This ruling reinforces that geographic location does not exempt organisations from GDPR obligations when they actively offer services to EU residents. Organisations that treat compliance as a checkbox risk regulatory action, reputational harm, and eroding user trust.","**Immediate actions:**\n- Audit all data subject access request (DSAR) response formats to ensure output is human-readable, contextual, and not raw machine-readable data dumps.\n- Review all privacy notices to confirm they explicitly cover processing purposes, legal bases, retention periods, and international data transfer mechanisms.\n\n**Long-term improvements:**\n- Implement a dedicated GDPR compliance programme that maps data flows, classifies personal data, and assigns ownership for transparency obligations.\n- Establish a legal review process for any service launched in EU markets, regardless of the organisation's country of incorporation.\n- Train product and engineering teams on GDPR-by-design principles so transparency requirements are built into data access features from the start.\n\n**Detection & monitoring measures:**\n- Schedule periodic third-party GDPR compliance audits covering transparency, access rights, and cross-border transfer documentation.\n- Monitor regulatory guidance and DPA rulings across EU member states to proactively identify compliance gaps before enforcement action occurs.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 12 – Transparent information and communication","GDPR Article 13 – Information to be provided where personal data are collected","GDPR Article 14 – Information where personal data have not been obtained from the data subject","GDPR Article 15 – Right of access by the data subject","GDPR Article 44-49 – Transfers of personal data to third countries","NIST Privacy Framework PR.PO-P1 – Policies and procedures for privacy practices","NIST SP 800-53 IP-1 – Consent","NIST SP 800-53 IP-2 – Individual Access","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Management – Compliance and governance processes",{},"published","2026-10-02T10:21:23.576843+00:00","2026-10-02T10:21:23.507+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_2025-0.626.844&diff=53283&oldid=53282","dsb-austria-2025-0-626-844-3942b8","DSB (Austria) - 2025-0.626.844",[33,39],{"id":34,"name":35,"slug":36,"description":37,"color":38},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]