General Data Protection Regulation (GDPR) , Standards, Regulations & Compliance

Spotify Fined 5 Million Euros for GDPR Violations

Online Music Streamer Will Appeal Decision From Swedish Data Protection Authority
Spotify Fined 5 Million Euros for GDPR Violations
An entrance to a Spotify office in Stockholm, Sweden in a photo dated Jan. 30, 2021 (Image: Shutterstock)

Swedish privacy regulators ordered Spotify to pay 5 million euros after finding the music streaming service not forthcoming enough with how it uses consumer data.

See Also: Stronger Security Through Context-aware Change Management: A Case Study

The Swedish Authority for Privacy Protection, or IMY, on Tuesday imposed the fine of 58 million Swedish kroner in a statement saying Spotify should be more specific about how and for which purposes it collects individuals' data.

The fine is the outcome of a four-year-long investigation by the agency based on complaints, including from Austrian privacy activist group NOYB, that invoked the General Data Protection Regulation's section on the individual right to access their personal data.

Spotify in an emailed statement said the investigation revealed that "only minor areas of our process" were at odds with the GDPR. "Spotify offers all users comprehensive information about how personal data is processed," the spokesperson said. "We don’t agree with the decision and plan to file an appeal," the spokesperson added.

In its 2019 complaint, NOYB alleged online streaming platforms, including Spotify, had failed to provide users all data on how their personal information was being processed. Authorities transferred jurisdiction over the complaint, originally filed in Austria, to Sweden since the company's European headquarters is located in Stockholm.

The investigation by the Swedish agency found that between November 2021 and May 2022, Spotify had processed users' personal data in violation of a requirement that companies be transparent on the purpose of personal data process, the types of recipients of personal data and whether protective measures are in place when personal data is transferred to third countries.

Although Spotify had necessary measures in place to inform its users regarding how their data is processed, the Swedish agency said the notification was "generalized," meaning that the company was providing the same information regardless of who requested the information.

The action from the Swedish authority comes after NOYB took to the Swedish courts to force a decision from IMY. That case is still under review.

"It is a basic right of every user to get full information on the data that is processed about them," Stefano Rossetti, privacy lawyer at NOYB, said.

Spotify has been given a deadline of one month to bring its existing data processing requirements into compliance.


About the Author

Akshaya Asokan

Akshaya Asokan

Senior Correspondent, ISMG

Asokan is a U.K.-based senior correspondent for Information Security Media Group's global news desk. She previously worked with IDG and other publications, reporting on developments in technology, minority rights and education.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing gdpr.inforisktoday.com, you agree to our use of cookies.