The Dutch Data Protection Authority (DPA) fined Netflix €4.75 million ($4.98 million) over transparency failures under the General Data Protection Regulation (GDPR).
The issues covered the period from 2018 to 2020. The DPA began investigating in 2019 and found that Netflix had not explained clearly enough how it collected, processed, and used customers’ personal data.
The regulator also found that Netflix’s responses to customers asking about their personal data did not meet GDPR transparency requirements.
GDPR has applied since 2018 and requires organizations to explain how personal data is handled and to give people access to information about their own data.
At the time this article was published in December 2024, Netflix had updated its privacy statement and the way it handled data-related information requests. The company was also challenging the DPA fine.
Historical note: this article records the status of the enforcement action as reported in December 2024. It should not be read as a statement about the current status of any appeal.
The case is a reminder that privacy compliance is not only about having a privacy policy. Companies also need to explain their data practices clearly enough for users to understand what happens to their information and how to exercise their rights.
