This is not a Hugo issue.
The CSV is private: You either need to make it public or use authentication.