Google LLC – Complaint Upheld (Austria, 2025)

A data subject, represented by noyb, brought a complaint against Google LLC (the controller) in January 2019. According to the data subject, the controller did not provide them with complete information following an access request for the YouTube service; instead, the controller provided limited information through a download portal, which excluded information the controller stated it would process in accordance with its privacy policy. For example, the data provided did contain information on the data processed through cookies or Facebook pixels. The DPA initiated the One-Stop Shop procedure and forwarded the case to the Irish DPA, who also believed it should be considered the lead DPA for the proceedings. However, the Irish DPA ultimately declared it was not responsible in 2022, and referred the case back to the DPA. The controller argued that the data subject had incorrectly initiated proceedings against them, as it was not the controller within the meaning of the GDPR. In addition, it argued that the data subject had received complete information and that its DPO was not responsible. The DPA first emphasised the importance of the right to access (Article 15 GDPR), as it enables the data subject to verify whether a controller is processing personal data lawfully. In addition, Article 12(2) GDPR places an obligation on controllers to facilitate data subjects in exercising their rights. The DPA then dismissed the controller’s argument to reject the complaint, as Google LLC was the controller at the time the case was filed with the DPA. Furthermore, the DPA stated that it would have not dismissed the case even if the data subject had not chosen an entirely accurate name for the controller; it was clear that the data subject wanted to prosecute the entity responsible for the YouTube service. The DPO was considered responsible for handling the complaint, as the Irish branch was not considered the controller for YouTube. The DPA found a violation of Article 12(1) GDPR. The download portal provided information in formats design for machine processing, meaning it was not accessible for the average data subject. In addition, the controller stated that someone of the information may have been available in other secure online tools; this meant the data subject could not access a complete copy of their data through the online portal. The DPA also found violation of Article 15 GDPR, as the controller had not given the data subject sufficient information. According to the DPA, the controller’s privacy policy can fulfil the information obligations of Article 13 and 14 GDPR, but not Article 15 GDPR. This is because it is general information and may not apply to the data subject. The controller must also provide specific information relevant for the data subject, meaning it is not enough to give general statements. This applied to the processing purposes, categories of data, storage periods, tracking, and recipients of data. For the recipients of data, the DPA noted that as a leading IT company the controller could specify the specific recipients of the personal data, and the safeguards in place for third country transfers. The DPA ordered the controller to provide the data subject with a complete copy of their data. The DPA specified that referring to its privacy policy or the different online tools the data subject could use to compile the information themselves was not enough to comply with Article 12 GDPR.