Netflix fined for not properly informing customers

The Dutch data protection authority (DPA) has imposed a fine of €4.75 million onto Netflix for providing insufficient information about what the company did with user data between 2018 and 2020.

According to the Autoriteit Persoonsgegevens, Netflix didn’t comply with the General Data Protection Regulation (GDPR) during this period.

The streaming service failed to provide clear and specific information about the purposes and legal basis for processing personal data, such as email addresses, phone numbers, payment details and what movies and series customers watch on the platform.

In addition, Netflix was vague about the recipients of the data, the retention period for data, and international data transfers.

Furthermore, when responding to access requests, the streaming service didn’t provide specific information about what data was used for what purpose, which parties received the data, how long the data would be retained, and what safeguards were in place for data transfers outside the EU.

Netflix argued that its privacy statement was in compliance with the GDPR, and that naming general categories for recipients was more than sufficient. On top of that, since 2022 the company has made improvements to provide more information to customers, such as adding links to a list of recipients and countries for international data transfers.

The Dutch DPA doesn’t see it that way and concluded that Netflix provided too little information to customers, and that the information that was provided was unclear. Therefore, the Autoriteit Persoonsgegevens has imposed an administrative fine of €4.75 million onto Netflix.

“A company like that, with a turnover of billions and millions of customers worldwide, has to explain properly to its customers how it handles their personal data. That must be crystal clear. Especially if the customer asks about this. That wasn't the case,” Dutch DPA chairman Aleid Wolfsen says in a statement.

Austrian privacy advocacy group Noyb, who filed the complaint on behalf of users, is happy with the outcome, but regrets it took five years to come to a decision. “We are happy with the DPA’s decision to issue a fine against Netflix. However, it took almost five years to obtain it, and in a very simple case,” Stefano Rossetti, data protection lawyer at Noyb, says in a statement.

Netflix is allowed to submit a notice of objection to the Dutch DPA, but has to do this within the next six weeks.