Netflix late last year launched a brand new type of content — a choose-your-own-adventure film that let you make various choices while watching the movie, which would alter its course.
If you’ve seen Black Mirror: Bandersnatch, then you know what the film has to offer, and you’ve probably experienced various endings . It’s not the greatest Netflix film, and it doesn’t feel that interactive, but it’s a remarkable achievement for the company, as everything works without a hitch. It turns out, however, that there may be an unexpected side-effect of this type of genre, which Netflix wants to proliferate in the coming years, and that’s data collection.
It shouldn’t be a big surprise to hear that a company like Netflix collects data about you, but it might be surprising to hear that Netflix is interested in all the choices you made during Bandersnatch, and has a collection of that data for every viewer, Motherboard reports. A tech policy researcher from the UK used the new GDPR privacy law of the EU to ask Netflix what data was collected from Bandersnatch.
“People had been speculating a lot on Twitter about Netflix’s motivations,” Michael Veale told the blog. “I thought it would be a fun test to show people how you can use data protection law to ask real questions you have.”
The research found that Netflix is indeed collecting your decisions, and keeping them after you’ve finished the film. The company told Veale that it stores aggregated forms of the users choices to “help [Netflix] determine how to improve this model of storytelling in the context of a show or movie.”
While the researcher was able to obtain the data, it turns out that it was somewhat tricky to get it, as he had to be very specific about what he wanted.
“It was tricky, as I had to ask these questions specifically,” Veale added. “It’s unclear if this is included by default in requests to get your data from Netflix or not—I can tell you often this kind of specific data is not included when you ask for ‘all your data.’ Knowing what ‘all your data’ is, and what the company’s definition of ‘all your data’ does not include, is most of the challenge.”
The researcher points out that Netflix never told him how long it keeps that data and what the deletion plans are.
“They claim they’re doing the processing as it’s ‘necessary’ for performing the contract between me and Netflix,” he said. “Is storing that data against my account really ‘necessary’? They clearly haven’t delinked it or anonymized it, as I’ve got access to it long after I watched the show. If you asked me, they should really be using consent (which you should be able to refuse) or legitimate interests (meaning you can object to it) instead.”
At least now that the story is out in the open, Netflix will have to figure out an explanation for all of this, especially considering that it plans to make more choose-your-own-adventure shows in the future.
Check out the following Twitter thread to get the full story from Veale:
Remember everyone quickly speculating whether Black Mirror: Bandersnatch was a data mining experiment. I used my GDPR right of access to find out more. (short thread) #Bandersnatch
— Michael Veale (@mikarv) February 12, 2019
