YouTube directed by Austrian authorities to Grant Data Access in Response to 5-Year Long Data Request Case
YouTube Faces Four-Week Deadline to Comply with GDPR Data Access Ruling
In a landmark decision, the Austrian Data Protection Authority (DSB) has ruled that Google's YouTube violated the General Data Protection Regulation (GDPR) data access requirements on August 7, 2025. The ruling, which addresses data controller identification challenges common with multinational technology companies, provides clear guidance for both controllers and supervisory authorities implementing Article 15 requirements.
The DSB's detailed technical analysis of acceptable data formats and response comprehensiveness is a significant step forward in ensuring transparency obligations are met. The authority found that providing raw data in technical formats like JSON and OPML without explanation tools violates these obligations.
The ruling stems from a data access request made by an unnamed complainant in October 2018, which was inadequately handled for over five years. The authority emphasized that GDPR Article 15 establishes comprehensive access rights, including receiving copies of personal data alongside detailed information about processing purposes, recipients, retention periods, and sources.
Google, however, argued that the request lacked sufficient precision. The DSB rejected this argument, noting that users can demand complete data disclosure without limiting the scope of the request. The company must comply with the access order during any appeal process unless suspension is specifically granted.
YouTube faces a four-week deadline to comply with the DSB's ruling or face potential enforcement actions. Data protection authorities across Europe are likely to reference this decision when evaluating similar access request complaints.
The case demonstrates the strategic approach of the privacy advocacy group noyb in enforcing privacy regulations. The organization has targeted systematic compliance failures across major technology platforms, including filing GDPR complaints against TikTok, WeChat, and AliExpress in July 2025.
Google updated its platform policies with a focus on privacy in December 2024. The timeline of this case reveals significant enforcement system challenges that may influence future regulatory approaches, with five-year resolution periods undermining the GDPR's fundamental premise of prompt data access.
The ruling also establishes important precedent for access request quality standards across the European Union, particularly regarding technical format requirements and the inadequacy of privacy policy references as substitutes for personalized information.
Google retains appeal rights to the Federal Administrative Court within four weeks of the decision. The organization that imposed a fine on Google's YouTube in Germany on August 7, 2025, for violations of GDPR access requirements has not been identified in the available search results.
Read also:
- Understanding Hemorrhagic Gastroenteritis: Key Facts
- Expanded Community Health Involvement by CK Birla Hospitals, Jaipur, Maintained Through Consistent Outreach Programs Across Rajasthan
- Abdominal Fat Accumulation: Causes and Strategies for Reduction
- Deepwater Horizon Oil Spill of 2010 Declared Cleansed in 2024?
