DSB (Austria) - 2025-0.626.844

Summary

The Austrian Data Protection Authority (DSB) upheld a complaint against Google LLC concerning an access request for YouTube data. The data subject, represented by noyb, argued that Google did not provide a complete copy of their personal data, offering only limited information through a download portal that excluded data processed via cookies or Facebook pixels. The DSB ordered Google to provide the data subject with a full copy of their personal data.

Full text

Help DSB (Austria) - 2025-0.626.844: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 08:26, 2 October 2026 view sourceLh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators111 editsmTag: Visual edit← Older edit Latest revision as of 11:23, 9 October 2026 view source Lh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators111 edits Tag: Visual edit: Switched Line 7: Line 7: |DPA_With_Country=DSB (Austria)|DPA_With_Country=DSB (Austria) |Case_Number_Name=2025-0.626.844|Case_Number_Name=D130.200 |ECLI=ECLI:AT:DSB:2025: 2025.0.626.844|ECLI= |Original_Source_Name_1=DSB |Original_Source_Name_1=RIS|Original_Source_Link_1=https://gdprhub.eu/images/9/90/DSB_D.130.200-redacted.pdf |Original_Source_Link_1=https://www.ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=683f918c-ba0e-4d34-b95b-e8de43e0c72c&Abfrage=Gesamtabfrage&SearchInAsylGH=&SearchInAvn=&SearchInAvsv=&SearchInBegut=&SearchInBgblAlt=&SearchInBgblAuth=&SearchInBgblPdf=&SearchInBks=&SearchInBundesnormen=&SearchInBvb=&SearchInBvwg=&SearchInDok=&SearchInDsk=&SearchInEat=&SearchInErlaesse=&SearchInGbk=&SearchInGemeinderecht=&SearchInGemeinderechtAuth=&SearchInJustiz=&SearchInKmGer=&SearchInLandesnormen=&SearchInLvwg=&SearchInLgbl=&SearchInLgblNO=&SearchInLgblAuth=&SearchInMrp=&SearchInNormenliste=&SearchInPruefGewO=&SearchInPvak=&SearchInRegV=&SearchInSpg=&SearchInUbas=&SearchInUmse=&SearchInUpts=&SearchInUvs=&SearchInVbl=&SearchInVerg=&SearchInVfgh=&SearchInVwgh=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=&ResultPageSize=100&Suchworte=2025-0.626.844&Dokumentnummer=DSBT_20250807_2025_0_626_844_00 |Original_Source_Language_1=German|Original_Source_Language_1=German |Original_Source_Language__Code_1=DE|Original_Source_Language__Code_1=DE |Original_Source_Name_2=|Original_Source_Name_2= |Original_Source_Link_2=|Original_Source_Link_2= Line 23: Line 20: |Type=Complaint|Type=Complaint |Outcome=|Outcome=Upheld |Date_Started=|Date_Started=18.01.2019 |Date_Decided=07.08.2025|Date_Decided=07.08.2025 |Date_Published=|Date_Published= Line 31: Line 28: |Currency=|Currency= |GDPR_Article_1=Article 12(1) GDPR |GDPR_Article_Link_1=Article 12 GDPR#1 |GDPR_Article_2=Article 12(2) GDPR |GDPR_Article_Link_2=Article 12 GDPR#2 |GDPR_Article_3=Article 13 GDPR |GDPR_Article_Link_3=Article 13 GDPR |GDPR_Article_4=Article 14 GDPR |GDPR_Article_Link_4=Article 14 GDPR |GDPR_Article_5=Article 15 GDPR |GDPR_Article_Link_5=Article 15 GDPR |GDPR_Article_6= |GDPR_Article_Link_6= |GDPR_Article_7= |GDPR_Article_Link_7= |GDPR_Article_1=Article 15(1) GDPR|EU_Law_Name_1= |GDPR_Article_Link_1=Article 15 GDPR#1|EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |GDPR_Article_2=Article 15(2) GDPR|Party_Name_1=Google LLC |GDPR_Article_Link_2=Article 15 GDPR#2|Party_Link_1= |Party_Name_2= |Party_Link_2= |Party_Name_3= |Party_Link_3= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |Initial_Contributor=ap | }} The DPA upheld a complaint regarding an access request, and ordered Google LLC to provide the data subject with a full copy of their personal data on YouTube. == English Summary == === Facts === A data subject, represented by ''noyb'', brought a complaint against Google LLC (the controller) in January 2019. According to the data subject, the controller did not provide them with complete information following an access request for the YouTube service; instead, the controller provided limited information through a download portal, which excluded information the controller stated it would process in accordance with its privacy policy. For example, the data provided did contain information on the data processed through cookies or Facebook pixels. The DPA initiated the One-Stop Shop procedure and forwarded the case to the Irish DPA, who also believed it should be considered the lead DPA for the proceedings. However, the Irish DPA ultimately declared it was not responsible in 2022, and referred the case back to the DPA. |GDPR_Article_3=Article 12(1) GDPRThe controller argued that the data subject had incorrectly initiated proceedings against them, as it was not the controller within the meaning of the GDPR. In addition, it argued that the data subject had received complete information and that its DPO was not responsible. |GDPR_Article_Link_3=Article 12 GDPR#1 === Holding === The DPA first emphasised the importance of the right to access ([[Article 15 GDPR]]), as it enables the data subject to verify whether a controller is processing personal data lawfully. In addition, [[Article 12 GDPR#2|Article 12(2) GDPR]] places an obligation on controllers to facilitate data subjects in exercising their rights. The DPA then dismissed the controller’s argument to reject the complaint, as Google LLC was the controller at the time the case was filed with the DPA. Furthermore, the DPA stated that it would have not dismissed the case even if the data subject had not chosen an entirely accurate name for the controller; it was clear that the data subject wanted to prosecute the entity responsible for the YouTube service. The DPO was considered responsible for handling the complaint, as the Irish branch was not considered the controller for YouTube. |GDPR_Article_4=The DPA found a violation of [[Article 12 GDPR#1|Article 12(1) GDPR]]. The download portal provided information in formats design for machine processing, meaning it was not accessible for the average data subject. In addition, the controller stated that someone of the information may have been available in other secure online tools; this meant the data subject could not access a complete copy of their data through the online portal. |GDPR_Article_Link_4= |GDPR_Article_5=The DPA also found violation of [[Article 15 GDPR|Article 15 GDPR]], as the controller had not given the data subject sufficient information. According to the DPA, the controller’s privacy policy can fulfil the information obligations of [[Article 13 GDPR|Article 13]] and [[Article 14 GDPR|14 GDPR]], but not [[Article 15 GDPR|Article 15 GDPR]]. This is because it is general information and may not apply to the data subject. The controller must also provide specific information relevant for the data subject, meaning it is not enough to give general statements. This applied to the processing purposes, categories of data, storage periods, tracking, and recipients of data. For the recipients of data, the DPA noted that as a leading IT company the controller could specify the specific recipients of the personal data, and the safeguards in place for third country transfers. |GDPR_Article_Link_5= The DPA ordered the controller to provide the data subject with a complete copy of their data. The DPA specified that referring to its privacy policy or the different online tools the data subject could use to compile the information themselves was not enough to comply with [[Article 12 GDPR|Article 12 GDPR]]. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' |EU_Law_Name_1=== English Machine Translation of the Decision == |EU_Law_Link_1=The decision below is a machine translation of the German original. Please refer to the German original for more details. <pre> Barichgasse 40-42 A-1030 Vienna Tel.: +43-1-52152 E-mail: dsb@dsb.gv.at Reference number: D130.200 Officer: 2025-0.626.844 Attn: NOYB - European Center for Digital Rights Data Protection Complaint (Right to Information) /Google LLC via email: DECISION RULING The Data Protection Authority decides on the data protection complaint filed by , represented by NOYB - European Center for Digital Rights, dated January 18, 2019, against Google LLC (respondent), represented by Baker McKenzie Attorneys at Law for violation of the right to information as follows: 1. The complaint is upheld

Entities