Silme Hakkının Kullanılmasının Kolaylaştırılması

EDPBI:NL:OSS:D:2023:1062 — NL SA final decision (Article 32 (Security of processing), Article 5 (Principles relating to processing of personal data))

To:
(By email)
13 December 2023
DPC Ref:
Re: v Netflix International B.V.

Dear ,

This is a decision of the Data Protection Commission (DPC) in relation to your complaint
originally lodged on 28 September 2020 against Netflix International B.V. (Netflix). As you
are already aware, the Dutch Data Protection Authority (Dutch DPA) investigated your
complaint because it was the lead supervisory authority for Netflix. This decision is based on
the investigation and information provided to the DPC by the Dutch DPA.

Preliminary Draft Decision of the Dutch DPA dated 25 November 2022

Following the conclusion of the initial investigation into the complaint, the Dutch DPA issued
the DPC with a preliminary draft decision. This preliminary draft decision was considered by
the DPC and provided to you for your views. The DPC provided your views to the Dutch DPA
on 11 January 2023 and requested that they be addressed prior to the preparation of the
Dutch DPA’s draft decision.

Draft Decision of the Dutch DPA dated 18 May 2023

Following its consideration of the views you expressed on the preliminary draft decision, and
after further consultation with you and the DPC in relation thereto, the Dutch DPA issued a
draft decision in relation to your complaint pursuant to Article 60(3) of the General Data
Protection Regulation (GDPR) on 18 May 2023. The draft decision found no infringement by
Netflix of Article 17 GDPR in relation to your complaint and therefore proposed to reject your
complaint in full.

Following consultations between the DPC, the Dutch DPA and the other European
supervisory authorities concerned by the processing activities in question, an objection was
raised by the Finnish Data Protection Authority (Finnish DPA). That objection was made on
the basis that that the Finnish DPA had formed the view that, in light of the facts and analysis
set out in the draft decision, an infringement by Netflix of Article 12(2) GDPR had occurred
and that the draft decision should be amended to include such a finding.

An Coimisiún um Chosaint Sonraí, 21 Cearnóg Mhic Liam, Baile Átha Cliath 2, Éire.
Data Protection Commission, 21 Fitzwilliam Square, Dublin 2, Ireland.
www.cosantasonrai.ie | www.dataprotection.ie | [email protected] | [email protected] Tel: +353 (01)7650100

Revised Draft Decision of the Dutch DPA dated 14 August 2023

Following consideration of the objection raised by the Finnish DPA, the Dutch DPA agreed to
follow the objection. Accordingly, the Dutch DPA subsequently issued a revised draft decision
in relation to your complaint pursuant to Article 60(5) GDPR, whereby it found an
infringement by Netflix of Article 12(2) GDPR. The finding of no infringement by Netflix of
Article 17 GDPR in relation to your complaint remained unchanged.

Final Decision of the Dutch DPA dated 19 October 2023

Following further consultation in relation to the revised draft decision between the DPC, the
Dutch DPA and the other European supervisory authorities concerned by the processing
activities in question, no further objections were made. Accordingly, the Dutch DPA
proceeded to issue a final decision in relation to your complaint, which is binding in
accordance with Article 60(6) GDPR. The final decision and reasoning of the Dutch DPA is
enclosed for your information.

Based on its investigation into the matter, as well as the objection raised by the Finnish SA,
the Dutch DPA identified and acted upon an infringement of Article 12(2) GDPR by Netflix,
and rejected the remaining elements of your complaint (namely, in relation to Article 17
GDPR).

The final decision of the Dutch DPA therefore constitutes a partial rejection of your complaint
for the purposes of Article 60(9) GDPR. The final decision and reasoning of the Dutch DPA, to
which the DPC had no objection, is enclosed for your information.

The DPC’s role in relation to your complaint

The DPC’s initial investigation confirmed that the processing at issue in relation to your
complaint was ‘cross border’ for the purpose of applying the GDPR. This meant that the DPC’s
role in relation to your complaint was as a concerned supervisory authority, and that the
investigation into your complaint would be conducted by the lead supervisory authority for
Netflix, the Dutch DPA.

The DPC informed you on 5 February 2021 that the Dutch DPA were the lead supervisory
authority competent to investigate your complaint. The DPC forwarded your complaint to

the Dutch DPA and provided you with regular updates in relation to your complaint. The DPC
also ensured that your views were heard on the Dutch DPA’s draft decision (via the views you
expressed on the preliminary draft decision provided to you) and that these were
appropriately accounted for by the Dutch DPA before the final decision became binding. The
DPC also independently assessed the Dutch DPA’s draft decision and revised draft decision
as part of its obligations as a Concerned Supervisory Authority pursuant to the cooperation
and consistency mechanism under Article 60 of the GDPR.

Decision of the DPC

Pursuant to Article 60(9) GDPR, as the supervisory authority with which the complaint was
lodged, the DPC must adopt and issue the final decision for the part concerning the rejection
of your complaint. Accordingly, the purpose of this letter is to notify you that the DPC has
adopted the part concerning the rejection of your complaint, as set out in the enclosed final
decision of the Dutch DPA, for the purposes of Article 60(9) GDPR.

A copy of this letter and adopted final decision will also be provided to Netflix for its
information.

Your right to an effective judicial remedy

Article 78 GDPR entitles you to an effective judicial remedy against a legally binding decision
of a supervisory authority. The adopted final decision of the DPC for the part concerning the
rejection of your complaint is a “legally binding decision” of the DPC as defined by section
150 (12) of the Data Protection Act 2018 (Act). Pursuant to section 150 (5) of the Act, you
may, within 28 days from the date you received this notice from the DPC, appeal against this
decision to either the Circuit Court or the High Court.

Next Steps

As the Dutch DPA has completed its investigation into this matter and the DPC has issued
you with the Dutch DPA’s final decision (which the DPC has adopted for the part concerning
the rejection of your complaint) and informed of your rights, the DPC will close its file in
relation to your complaint.

Yours sincerely,

_____________________________

Deputy Commissioner

Data Protection Commission

Silme Hakkının Kullanılmasının Kolaylaştırılması

Türkçe özet

Hukuki mesele

Sonuç

Karar metni