This post is also available in:
עברית (Hebrew)
The Dutch Data Protection Authority (DPA) has imposed a fine on Netflix for not adequately informing users about how their personal data is handled. The fine comes after a lengthy investigation that began five years ago following a complaint about the streaming service’s lack of transparency regarding its data practices between 2018 and 2020.
Netflix collects extensive personal data from its users, including email addresses, phone numbers, payment details, and viewing habits. However, the streaming giant failed to provide clear and sufficient explanations about how this data is used, shared, and retained. In particular, it did not clarify the purposes behind collecting user data, the legal basis for its use, or the specifics of how data is shared with third parties.
Additionally, Netflix did not inform users about how long their data would be kept or how the company protects personal information when it is transmitted to other countries. These omissions are considered violations of Article 15 of the General Data Protection Regulation (GDPR), which mandates that companies disclose detailed information about their data handling practices when requested by users.
The investigation into Netflix was initiated by complaints from the Austrian data privacy group Noyb in January 2019. Noyb filed complaints against multiple streaming services, including Amazon, Apple Music, and YouTube, which were forwarded to the Dutch DPA due to Netflix’s European headquarters being located in the Netherlands.
Aleid Wolfsen, Chairman of the Dutch DPA, emphasized the importance of transparency for companies with significant global reach like Netflix. “A company like that, with billions in revenue and millions of customers, must clearly explain how it handles personal data,” Wolfsen said.
In response to the ruling, Netflix has updated its privacy statement to improve clarity and transparency around its data usage, ensuring better communication with users moving forward. While the fine marks a significant step, the nearly five-year delay in enforcement has raised concerns about the efficiency of regulatory actions in such straightforward cases.
