By 
The Dutch Data Protection Authority (Dutch DPA) has imposed a fine of €4.75 million (approximately $4.95 million) on Netflix for alleged violations of the General Data Protection Regulation (GDPR). The penalty pertains to practices between 2018 and 2020, during which Netflix reportedly failed to adequately inform its customers about the handling of their personal data.
According to the Dutch DPA, Netflix’s privacy statement lacked clarity, and the company did not provide sufficient information to users who requested details about the data collected. This was highlighted in a press release issued on December 18.
Lack of Transparency in Data Practices
“A company of Netflix’s scale, with billions in revenue and millions of customers worldwide, has a responsibility to clearly explain how it handles personal data,” stated Aleid Wolfsen, Chairman of the Dutch DPA. “This information must be crystal clear, particularly when customers make inquiries. Unfortunately, this was not the case.”
The press release acknowledged that Netflix has since revised its privacy statement and improved the information it provides to users.
Netflix Responds to the Fine
In response to the decision, a Netflix spokesperson stated:
“Since this investigation began over five years ago, we have cooperated with the Dutch Data Protection Authority and proactively evolved our privacy information to provide even greater clarity to our members. We have objected to this decision.”
The Dutch DPA also noted that Netflix contested the ruling, arguing that the regulator applied an overly stringent interpretation of GDPR rules. Netflix asserted that its privacy statement invited customers to reach out for further information regarding personal data, cookies, and other technologies.
GDPR Enforcement in Focus
This case is one of several high-profile enforcement actions under the GDPR. For instance:
- In August 2023, the Dutch DPA fined Uber €290 million ($324 million) for transferring drivers’ personal data to the United States without adequate protections. Uber has since resolved the violation.
- In May 2023, the Irish Data Protection Commission fined Meta Platforms $1.3 billion, citing violations related to the transfer of European Facebook users’ data to the U.S. Meta was also ordered to suspend future data transfers and cease unlawful processing of EU users’ personal data.
Implications for Data Protection
These cases underscore the increasing scrutiny global companies face regarding data privacy and compliance with GDPR. Regulators are sending a clear message: transparency and accountability in handling personal data are non-negotiable
Comments