Spotify Fined 5 Million Euros for GDPR Violations – Source: www.govinfosecurity.com

General Data Protection Regulation (GDPR)
,
Standards, Regulations & Compliance

Online Music Streamer Will Appeal Decision From Swedish Data Protection Authority

Akshaya Asokan (asokan_akshaya) •
June 13, 2023    

Swedish privacy regulators ordered Spotify to pay 5 million euros after finding the music streaming service not forthcoming enough with how it uses consumer data.

See Also: Live Webinar | Breaking Down Security Challenges so Your Day Doesn’t Start at 3pm

The Swedish Authority for Privacy Protection, or IMY, on Tuesday imposed the fine of 58 million Swedish kroner in a statement saying Spotify should be more specific about how and for which purposes it collects individuals’ data.

The fine is the outcome of a four-year-long investigation by the agency based on complaints, including from Austrian privacy activist group NOYB, that invoked the General Data Protection Regulation’s section on the individual right to access their personal data.

Spotify in an emailed statement said the investigation revealed that “only minor areas of our process” were at odds with the GDPR. “Spotify offers all users comprehensive information about how personal data is processed,” the spokesperson said. “We don’t agree with the decision and plan to file an appeal,” the spokesperson added.

In its 2019 complaint, NOYB alleged online streaming platforms, including Spotify, had failed to provide users all data on how their personal information was being processed. Authorities transferred jurisdiction over the complaint, originally filed in Austria, to Sweden since the company’s European headquarters is located in Stockholm.

The investigation by the Swedish agency found that between November 2021 and May 2022, Spotify had processed users’ personal data in violation of a requirement that companies be transparent on the purpose of personal data process, the types of recipients of personal data and whether protective measures are in place when personal data is transferred to third countries.

Although Spotify had necessary measures in place to inform its users regarding how their data is processed, the Swedish agency said the notification was “generalized,” meaning that the company was providing the same information regardless of who requested the information.

The action from the Swedish authority comes after NOYB took to the Swedish courts to force a decision from IMY. That case is still under review.

“It is a basic right of every user to get full information on the data that is processed about them,” Stefano Rossetti, privacy lawyer at NOYB, said.

Spotify has been given a deadline of one month to bring its existing data processing requirements into compliance.