According to a technology policy researcher, Netflix records all the choices you make in Black Mirror’s Bandersnatch episode. “Michael Veale, a technology policy researcher at University College London, wanted to know what data Netflix was collecting from Bandersnatch,” reports Motherboard. “People had been speculating a lot on Twitter about Netflix’s motivations,” Veale told Motherboard in an email. “I thought it would be a fun test to show people how you can use data protection law to ask real questions you have.” From the report: The law Veale used is Europe’s General Data Protection Regulation (GDPR). The GDPR granted EU citizens a right to access — anyone can request a wealth of information from a company collecting data. Users can formally request a company such as Netflix tell them the reason its collecting data, the categories they’re sorting data into, third parties it’s sharing the data with, and other information. Veale used this right of access to ask Netflix questions about Bandersnatch and revealed the answers in a Twitter thread. He found that Netflix is tracking the decisions its users make (which makes sense considering how the film works), and that it is keeping those decisions long after a user has finished the film. It is also stores aggregated forms of the users choice to “help [Netflix] determine how to improve this model of storytelling in the context of a show or movie,” the company said in its email response to him. The .csv and PDF files displayed Veale’s journey through Bandersnatch, every choice displayed in a long line for him to see.
After sending along a copy of his passport to prove his identity, Veale got the answers he wanted from Netflix via email and — in a separate email — a link to a website where he downloaded an encrypted version of his data. He had to use a Netflix-provided key to unlock the data, which came in the form of a .csv file and a PDF. Veale is concerned by what he learned. Netflix didn’t tell Veale how long it keeps the data and what the long term deletion plans are. “They claim they’re doing the processing as it’s ‘necessary’ for performing the contract between me and Netflix,” Veale told Motherboard. “Is storing that data against my account really ‘necessary’? They clearly haven’t delinked it or anonymized it, as I’ve got access to it long after I watched the show. If you asked me, they should really be using consent (which you should be able to refuse) or legitimate interests (meaning you can object to it) instead.”
Read more of this story at Slashdot.