YouTube directed by Austrian authority to comply with data access request following a five-year legal battle
In a series of developments, Google has been facing privacy-related issues over the past few years, with recent rulings in Europe setting important precedents for data access and automated systems.
December 2024: Google updates its platform policies with a focus on privacy. However, the decision highlights broader enforcement implications for automated access systems, particularly regarding technical data formats and the inadequacy of privacy policy references as substitutes for personalized information.
August 2025: The Austrian Data Protection Authority (DSB) ruled that Google's YouTube violated GDPR data access requirements. The ruling establishes important precedents for access request quality standards across the European Union, particularly regarding technical format requirements and the inadequacy of privacy policy references as substitutes for personalized information.
In this case, YouTube must provide full personal data access to a complainant whose request was inadequately handled for over five years. The DSB determined that Google's portal system for data access failed to meet Article 12's facilitation requirements.
The ruling's detailed technical analysis of acceptable data formats and response comprehensiveness provides clear guidance for both controllers and supervisory authorities implementing Article 15 requirements.
April 2025: The Austrian court also ruled Google reCAPTCHA unlawful without consent. The decision highlighted broader enforcement implications for automated access systems.
2019: The criticism of Google's handling of access to personal data on YouTube was raised by the U.S. Federal Trade Commission (FTC) and the New York Attorney General, Letitia James, who accused Google of violating children's privacy by collecting personal data without parental consent and using it for targeted advertising.
July 2025: Privacy advocates file GDPR complaints against TikTok, WeChat, and AliExpress.
It's worth noting that Google has appeal rights to the Federal Administrative Court within four weeks of the decision, but must comply with the access order during any appeal process unless suspension is specifically granted.
Google's privacy policy lists numerous potential processing purposes without specifying which apply to individual users. The complainant had specifically requested copies of all personal data, including tracking information such as cookies and advertising profiles.
YouTube faces a four-week deadline to comply or face potential enforcement actions. These developments underscore significant enforcement system challenges that may influence future regulatory approaches, with five-year resolution periods undermining the GDPR's fundamental premise that individuals can promptly access their data.
The case demonstrates noyb's strategic approach to privacy enforcement, targeting systematic compliance failures across major technology platforms. As Google continues to address these issues, it remains to be seen how these rulings will shape the future of data privacy and access in the tech industry.
Read also:
- Impact of Alcohol on the Human Body: Nine Aspects of Health Alteration Due to Alcohol Consumption
- Understanding the Concept of Obesity
- Microbiome's Impact on Emotional States, Judgement, and Mental Health Conditions
- Criticisms levelled by a patient advocate towards MPK's judgement on PCR testing procedures
