The Dutch Data Protection Authority (DPA) has imposed a €4.75 million ($4.93 million) fine on Netflix for inadequate transparency regarding user data handling between 2018 and 2020. A 2019 investigation revealed significant privacy violations under GDPR regulations.

Key Violations:
– Insufficient clarity in privacy statements about data collection and usage
– Inadequate response to user data requests
– Lack of transparency regarding third-party data sharing
– Unclear data retention policies
– Insufficient information about international data transfer security

The streaming giant failed to properly explain its handling of user information, including:
– Email addresses
– Phone numbers
– Payment details
– Viewing history

While Netflix has updated its privacy policies, the company is contesting the fine. DPA Chairman Aleid Wolfsen emphasized that companies of Netflix’s scale must maintain absolute transparency about personal data handling.

The complaint, initially filed by privacy advocacy group None of Your Business (noyb) in 2019, has taken nearly five years to resolve. Similar complaints by noyb against other streaming services have resulted in penalties, including Spotify’s €5 million fine from Swedish authorities in June 2023.