Fine of 4.750.000,00 EUR against Netflix for GDPR violations

Dutch Supervisory Authority fined Netflix for not properly informing customers. Netflix did not inform customers clearly enough in its privacy statement about what exactly Netflix does with those data (Article 5 (1)(a) and Article 12 (1) in conjunction with Article 13 (1)(c)(e) and (f); and Article 13(2)(a) GDPR).

The Dutch Supervisory Authority (SA) started this investigation following complaints from None of your business (noyb), an Austrian NGO that is committed to privacy. Those complaints were submitted to the Austrian data protection authority and forwarded to the Dutch SA, because Netflix has its main European establishment in the Netherlands.

The investigation shows that Netflix did not inform customers clearly enough in its privacy statement about what exactly Netflix does with those data (Article 5 (1)(a) and Article 12 (1) in conjunction with Article 13 (1)(c)(e) and (f); and Article 13(2)(a) GDPR).

Furthermore, customers did not receive sufficient information when they asked Netflix which data the company collects about them. (Article 5 (1)(a) and Article 12 (1); in conjunction with Article 15 (1)(a)(c) and (d) and Article 15 (2) GDPR). These are violations of the GDPR.

On several points, Netflix provided too little information to customers, or the information provided was unclear. The company was not clear enough about:

  • the purposes of and the legal basis for collecting and using personal data (Article 13 (1)(c) and Article 5 (1)(a) GDPR);
  • which personal data are shared by Netflix with other parties, and why precisely this is done (Article 13 (1)(e) and Article 15 (1)(c) GDPR);
  • how long Netflix retains the data (Article 13(2)(a) and Article 15 (1)(d) GDPR);
  • how Netflix ensures that personal data remain safe when the company transmits them to countries outside Europe Article 13 (1)(f) and Article 15 (2) GDPR).

The Dutch SA imposed a fine of 4 750 000,00 EUR against Netflix.

The decision is available here

(source: edpb.europa.eu/photo freepik.com)

Comments

Post a Comment

Popular posts from this blog

Greek Administrative Court rules state liable for Covid-19 vaccine side effects due to "excessive sacrifice"

Image
Greece: The Administrative Court of First Instance of Athens, in its decision no. 4202/2025, has ruled that the Greek State is liable for damages sustained by an individual due to side effects following a preventive "COVID-19" vaccination. This landmark decision was issued in a compensation lawsuit filed against the Hellenic Republic. The Case: Seeking Compensation for Vaccine-Related Harm The lawsuit was brought by a plaintiff seeking compensation for material damage and moral harm (non-pecuniary damage), alleging that they suffered severe side effects after their preventive COVID-19 vaccination with a specific vaccine. The initial claim was for €461,835.26, but this amount was subsequently restricted during the proceedings. The plaintiff based their claim on two legal grounds: Article 105 of the Introductory Law of the Civil Code (EισNAK): This article concerns the State's liability for compensation arising from illegal acts or omissions of its organs in the exe...
Read more

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

The Title Deed Issue in Cyprus and the "Trapped Buyers" Phenomenon

Image
Article By Giorgos Kazoleas, Lawyer LL.M.  The issue of title deeds in Cyprus and the phenomenon of "trapped buyers" constitutes one of the greatest legal, financial, and social peculiarities of Cypriot real estate law. The Cypriot Peculiarity: Sale Without a Title Deed Under Cypriot law (pursuant to the Immovable Property (Tenure, Registration and Valuation) Law, Cap. 224), legal ownership of a property is transferred and acquired solely upon its registration with the Department of Lands and Surveys and the issuance of the relevant Certificate of Registration (Title Deed). However, a major peculiarity exists: it is entirely legal to sell a property that does not (yet) possess a separate title deed. This typically occurs in new developments (apartment buildings or residential complexes), where the title deed for the plot of land belongs to the developer, but the separate title deeds for each apartment or house can take years to be issued due to bureaucracy, pending ap...
Read more

From Regulation to Strategy: Europe’s New Tech Agenda

Image
Written by Efi Thoma, Senior Global Legal Counsel  Europe’s approach to technology regulation is entering a more practical phase. After several years of ambitious rule-making, Brussels is increasingly focused on implementation, enforcement and simplification. For technology companies, the key question is no longer simply “What does the law require?” but “How do we make these requirements work in practice without unnecessarily slowing innovation?” The EU AI Act (Regulation (EU) 2024/1689) establishes a risk-based framework covering areas such as transparency, governance, human oversight and high-risk AI systems. As implementation progresses, the emphasis is increasingly on making the framework workable in practice, including through regulatory sandboxes and measures supporting implementation. For businesses, the practical approach is to embed AI governance into existing processes rather than create an entirely separate compliance structure. AI inventories, risk classification, procu...
Read more

Fully-funded PhD position in AI, Law and Public Power

Image
Erasmus University Rotterdam School of Law, department Law & Markets, is looking for a fulltime PhD researcher in AI, Law and Public Power (4,5 years with 20% teaching tasks). PhD AI, Law and Public Power Are you curious about how artificial intelligence is changing state actor powers? Do you want to conduct critical and in-depth legal research at the intersection of technology, law and power? And would you like to combine that with academic teaching? Then this PhD position at Erasmus School of Law is for you. Within the Law & Markets team, you will spend 4.5 years researching the legal regulation of AI in the public sector. How do we protect fundamental rights when algorithms help decide on who receives public benefits, how to perform enforcement or how to enact environmental policy? What is the role of the state, and where is the limit of government power in a data-driven society? You will have plenty of space to choose your own research angle and work in a multidisci...
Read more

Moving between Member States without an identity card or passport - A fine amounting to 20% of the amount of the offender’s average net monthly income, is not proportionate to the seriousness of the offence

Image
In its Judgment in Case C-35/20 (6.10.2021) , the European Court of Justice ruled that a Member State may require its nationals to carry a valid identity card or passport when travelling to another Member State, irrespective of the means of transport used and the itinerary, subject to sanctions. While EU law does not preclude the imposition of a criminal penalty, it does preclude disproportionate penalties, such as a fine amounting to 20% of the offender's average net monthly income. A, a Finnish national, made a round trip between Finland and Estonia in August 2015 on a pleasure boat. During that trip, he crossed the international waters between Finland and Estonia. He was the holder of a valid Finnish passport, but did not have it with him during that trip. As a result, during a border check in Helsinki on his return, A was unable to produce his passport or any other travel document, although his identity could be established on the basis of his driving licence. The syyttäjä ...
Read more

The struggle for truth against time and limitation period in the light of two paternity court cases

Image
By George Kazoleas, Lawyer Two recent cases, one by the European Court of Human Rights and the other by the Athens Court of First Instance with similar facts, show once again that justice can dispel the darkness caused by human deceit having as a result the distortion of real facts. Against time and limitation Time, was essentially the reason why the courts in Serbia denied the 50-year-old Peda Boljevic the right to know the truth about who his biological father was. Until 2011 he believed that A was his real father but when he died, Boljevic discovered in old court rulings around 1970 that A could not be his biological father. So, at the beginning of 2012, he filed a lawsuit with his mother, invoking the old decisions by also adding the argument that back then there was no DNA test, but today this could be done based on a court decree. The courts in Serbia, both the court of first instance and the court of appeals, rejected his application as lapsed, after so many years. In particular...
Read more