Veale told me that requesting the data was as easy as sending Netflix an email, but the specifics of getting the information he want were complicated. The GDPR right to access request works a lot like America’s Freedom of Information Act requests—the applicant needs to be very specific to get what they want. After sending along a copy of his passport to prove his identity, Veale got the answers he wanted from Netflix via email and—in a separate email—a link to a website where he downloaded an encrypted version of his data. He had to use a Netflix-provided key to unlock the data, which came in the form of a .csv file and a PDF.