A European privacy activist has filed complaints against a group of streaming services, including Apple, Netflix and YouTube, alleging that they have withheld data collected on its users in violation of the European Union's sweeping new privacy law.
Max Schrems, a noted privacy advocate who leads the group None of Your Business (NOYB), filed 10 complaints on Friday with the Austrian Data Protection Authority against eight companies for allegedly not following the EU's General Data Protection Regulation (GDPR).
“Many services set up automated systems to respond to access requests, but they often don’t even remotely provide the data that every user has a right to,” Schrems said in a statement. “In most cases, users only got the raw data, but, for example, no information about who this data was shared with. This leads to structural violations of users’ rights, as these systems are built to withhold the relevant information.”
Also among those hit with complaints were Amazon Prime and Spotify.
The GDPR requires companies to be more transparent about their data collection practices and give users more control over their own data. It gives users the right to learn about how they’re being tracked and to opt out of having their information collected.
Theoretically, under the GDPR’s tough enforcement mechanisms, a company could be hit with fines of up to about $23 million or 4 percent of a company’s global annual revenue if Europe’s data authorities find that it has violated the new law.
Schrems has been an outspoken critic of internet giants’ privacy practices. On the day the GDPR went into effect last year, NOYB filed complaints against Facebook and Google, accusing them of failing to let users opt out of their data collection.
Spotify responded to the complaint on Friday by pushing back on the notion that it violated the regulations.
"Spotify takes data privacy and our obligations to users extremely seriously," the company said in a statement. "We are committed to complying with all relevant national and international laws and regulations, including GDPR, with which we believe we are fully compliant."
None of the other companies named in the latest complaints immediately responded when asked for comment.
Updated at 1:07 p.m.