DSB (Austria) - D130.200

Summary

The Austrian Data Protection Authority (DSB) upheld a complaint against Google LLC regarding an access request for YouTube data. The complainant argued that Google provided incomplete information, excluding data processed via cookies or Facebook pixels. The DSB ruled that Google LLC was the responsible controller and ordered them to provide the data subject with a full copy of their personal data on YouTube, emphasizing the importance of the right to access.

Full text

Help DSB (Austria) - D130.200: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 07:24, 3 September 2025 view sourceAp (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators754 editsmTag: Visual edit← Older edit Latest revision as of 11:24, 9 October 2026 view source Lh (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators111 edits Tag: New redirect Line 1: Line 1: {{DPAdecisionBOX#REDIRECT [[DSB (Austria) - 2025-0.626.844]] |Jurisdiction=Austria |DPA-BG-Color= |DPAlogo=LogoAT.png |DPA_Abbrevation=DSB |DPA_With_Country=DSB (Austria) |Case_Number_Name=D130.200 |ECLI= |Original_Source_Name_1=DSB |Original_Source_Link_1=https://gdprhub.eu/images/9/90/DSB_D.130.200-redacted.pdf |Original_Source_Language_1=German |Original_Source_Language__Code_1=DE |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Type=Complaint |Outcome=Upheld |Date_Started=18.01.2019 |Date_Decided=07.08.2025 |Date_Published= |Year=2025 |Fine= |Currency= |GDPR_Article_1=Article 12(1) GDPR |GDPR_Article_Link_1=Article 12 GDPR#1 |GDPR_Article_2=Article 12(2) GDPR |GDPR_Article_Link_2=Article 12 GDPR#2 |GDPR_Article_3=Article 13 GDPR |GDPR_Article_Link_3=Article 13 GDPR |GDPR_Article_4=Article 14 GDPR |GDPR_Article_Link_4=Article 14 GDPR |GDPR_Article_5=Article 15 GDPR |GDPR_Article_Link_5=Article 15 GDPR |GDPR_Article_6= |GDPR_Article_Link_6= |GDPR_Article_7= |GDPR_Article_Link_7= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1=Google LLC |Party_Link_1= |Party_Name_2= |Party_Link_2= |Party_Name_3= |Party_Link_3= |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status= |Appeal_To_Link= |Initial_Contributor=ap | }} The DPA upheld a complaint regarding an access request, and ordered Google LLC to provide the data subject with a full copy of their personal data on YouTube. == English Summary == === Facts === A data subject, represented by ''noyb'', brought a complaint against Google LLC (the controller) in January 2019. According to the data subject, the controller did not provide them with complete information following an access request for the YouTube service; instead, the controller provided limited information through a download portal, which excluded information the controller stated it would process in accordance with its privacy policy. For example, the data provided did contain information on the data processed through cookies or Facebook pixels. The DPA initiated the One-Stop Shop procedure and forwarded the case to the Irish DPA, who also believed it should be considered the lead DPA for the proceedings. However, the Irish DPA ultimately declared it was not responsible in 2022, and referred the case back to the DPA. The controller argued that the data subject had incorrectly initiated proceedings against them, as it was not the controller within the meaning of the GDPR. In addition, it argued that the data subject had received complete information and that its DPO was not responsible. === Holding === The DPA first emphasised the importance of the right to access ([[Article 15 GDPR]]), as it enables the data subject to verify whether a controller is processing personal data lawfully. In addition, [[Article 12 GDPR#2|Article 12(2) GDPR]] places an obligation on controllers to facilitate data subjects in exercising their rights. The DPA then dismissed the controller’s argument to reject the complaint, as Google LLC was the controller at the time the case was filed with the DPA. Furthermore, the DPA stated that it would have not dismissed the case even if the data subject had not chosen an entirely accurate name for the controller; it was clear that the data subject wanted to prosecute the entity responsible for the YouTube service. The DPO was considered responsible for handling the complaint, as the Irish branch was not considered the controller for YouTube. The DPA found a violation of [[Article 12 GDPR#1|Article 12(1) GDPR]]. The download portal provided information in formats design for machine processing, meaning it was not accessible for the average data subject. In addition, the controller stated that someone of the information may have been available in other secure online tools; this meant the data subject could not access a complete copy of their data through the online portal. The DPA also found violation of [[Article 15 GDPR|Article 15 GDPR]], as the controller had not given the data subject sufficient information. According to the DPA, the controller’s privacy policy can fulfil the information obligations of [[Article 13 GDPR|Article 13]] and [[Article 14 GDPR|14 GDPR]], but not [[Article 15 GDPR|Article 15 GDPR]]. This is because it is general information and may not apply to the data subject. The controller must also provide specific information relevant for the data subject, meaning it is not enough to give general statements. This applied to the processing purposes, categories of data, storage periods, tracking, and recipients of data. For the recipients of data, the DPA noted that as a leading IT company the controller could specify the specific recipients of the personal data, and the safeguards in place for third country transfers. The DPA ordered the controller to provide the data subject with a complete copy of their data. The DPA specified that referring to its privacy policy or the different online tools the data subject could use to compile the information themselves was not enough to comply with [[Article 12 GDPR|Article 12 GDPR]]. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the German original. Please refer to the German original for more details. <pre> Barichgasse 40-42 A-1030 Vienna Tel.: +43-1-52152 E-mail: dsb@dsb.gv.at Reference number: D130.200 Officer: 2025-0.626.844 Attn: NOYB - European Center for Digital Rights Data Protection Complaint (Right to Information) /Google LLC via email: DECISION RULING The Data Protection Authority decides on the data protection complaint filed by , represented by NOYB - European Center for Digital Rights, dated January 18, 2019, against Google LLC (respondent), represented by Baker McKenzie Attorneys at Law for violation of the right to information as follows: 1. The complaint is upheld, and it is determined that the respondent has violated the complainant's right to information by incomplete information and the manner in which the information was provided violated his rights under Art. 15 GDPR in conjunction with Art. 12 GDPR. 2. The respondent is ordered to provide the complainant with complete information within the meaning of Art. 15 (1) and (2) GDPR regarding all personal data relating to him that are processed and to provide a copy of this personal data in an easy-to-understand and readable format within a period of four weeks, failing which he will be liable to execution. Legal basis: Article 12 (1) and (2), Article 15, Article 51 (1), Article 57 (1) (f), and Article 77 (1) of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: GDPR), OJ No. L 119 of 4 May 2016, p. 1; Sections 18 (1) and 24 (1) and (5) of the Data Protection Act (DSG), Federal Law Gazette I No. 165/1999, as amended. - 2 - R E A S T I O N A. Arguments of the parties and course of proceedings Comment by the Data Protection Authority on the course of proceedings: The course of proceedings does not constitute a legally binding element, but is optional. Therefore, there is generally no need to separately state the parties' submissions in the grounds for the decision (cf. Hengstschläger/Leeb, AVG § 60 para. 22 (as of March 1, 2023, rdb.at)). Due t

Entities