Michael Veale, a technology policy researcher at University College London, sent Netflix a data access request under Article 15 of the GDPR in order to answer this question. Netflix responded, providing a description of what they do with the data and a copy of the data they have on file. Although Veale still has questions—such as how long Netflix will hold onto the data and what they’re doing to keep it safe and encrypted—the action helped shed light on one of the most important rights under the GDPR.