€5 million fine against Spotify for GDPR violations

Swedish Authority for Privacy Protection (IMY) issued an administrative fine against Spotify for shortcomings regarding transparency.

The General Data Protection Regulation, GDPR, entered into force in 2018 and means, among other things, that the rights of individuals are strengthened. One such right is the right of access, which means a right for individuals to find out what personal data a business handles about the person in question and to receive information about how this data is used.

Due to complaints that the Swedish Authority for Privacy Protection (IMY) received against Spotify AB regarding the right of access, IMY has audited how Spotify handles the right for individuals to access their personal data.

IMY finds that Spotify provides to individuals the personal data the company processes when individuals request it. However, Spotify shall also provide information to the person requesting access about how Spotify uses this data and this information must be easy to understand. In addition, personal data that is difficult to understand, such as those of a technical nature, may need to be explained not only in English but in the individual's own, native language. In these parts, IMY has seen certain shortcomings in the audit of Spotify.

The deficiencies that have been discovered are considered overall to be of a low level of seriousness. In light of that and, among other things, the number of registered users and Spotify's turnover, IMY issued an administrative fine of almost EUR 5 million (SEK 58 million) against Spotify for not having provided sufficiently clear information to individuals.

IMY has found shortcomings related to the information pursuant to article 15.1 a-h and 15.2 of the GDPR that should be provided to the individual making the request and to the description of the data in the technical logfiles provided by Spotify. IMY has issued an administrative fine of SEK 58 million against Spotify for not providing sufficiently clear information to individuals in this regard. The decision in this part includes violations of articles 12.1, 15.1 a-d, g and 15.2 of the GDPR.

IMY has further found that Spotify had failed in its handling of requests for access related to two out of three of the complaints examined. The decision in this part includes violation of articles 12.1, 12.3, 15.3 and 15.1 a-h and 15.2 of the GDPR. In relation to these infringements IMY issued a reprimand and an order to comply with one complainant`s request of access. (source: edpb.europa.eu/ photo: freepik.com)

Follow Legalpost.eu on Facebook here




George Kazoleas, Lawyer

Top Stories

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Gigantic fine for unfair practices imposed on Booking.com by the Competition Authority of Hungary

The name Pablo Escobar may not be registered as an EU trade mark

First judgment of the ECHR: Lawless v. Ireland

Politically Exposed Persons (PEPs): What and Why?

McDonald’s loses the EU trade mark Big Mac in respect of poultry products

Airbnb is not required to hold an estate agent’s professional licence as it did not notify the Commission of that requirement in accordance with the Directive on electronic commerce