€5 million fine against Spotify for GDPR violations
Swedish Authority for Privacy Protection (IMY) issued an administrative fine against Spotify for shortcomings regarding transparency.
Due to complaints that the Swedish Authority for Privacy Protection (IMY) received against Spotify AB regarding the right of access, IMY has audited how Spotify handles the right for individuals to access their personal data.
IMY finds that Spotify provides to individuals the personal data the company processes when individuals request it. However, Spotify shall also provide information to the person requesting access about how Spotify uses this data and this information must be easy to understand. In addition, personal data that is difficult to understand, such as those of a technical nature, may need to be explained not only in English but in the individual's own, native language. In these parts, IMY has seen certain shortcomings in the audit of Spotify.
The deficiencies that have been discovered are considered overall to be of a low level of seriousness. In light of that and, among other things, the number of registered users and Spotify's turnover, IMY issued an administrative fine of almost EUR 5 million (SEK 58 million) against Spotify for not having provided sufficiently clear information to individuals.
IMY has found shortcomings related to the information pursuant to article 15.1 a-h and 15.2 of the GDPR that should be provided to the individual making the request and to the description of the data in the technical logfiles provided by Spotify. IMY has issued an administrative fine of SEK 58 million against Spotify for not providing sufficiently clear information to individuals in this regard. The decision in this part includes violations of articles 12.1, 15.1 a-d, g and 15.2 of the GDPR.
IMY has further found that Spotify had failed in its handling of requests for access related to two out of three of the complaints examined. The decision in this part includes violation of articles 12.1, 12.3, 15.3 and 15.1 a-h and 15.2 of the GDPR. In relation to these infringements IMY issued a reprimand and an order to comply with one complainant`s request of access. (source: edpb.europa.eu/ photo: freepik.com)