General Data Protection Regulation (GDPR) , Standards, Regulations & Compliance
Spotify Fined 5 Million Euros for GDPR Violations
Online Music Streamer Will Appeal Decision From Swedish Data Protection AuthoritySwedish privacy regulators ordered Spotify to pay 5 million euros after finding the music streaming service not forthcoming enough with how it uses consumer data.
See Also: Putting Data Privacy and Protection at the Center of Your Security Strategy
The Swedish Authority for Privacy Protection, or IMY, on Tuesday imposed the fine of 58 million Swedish kroner in a statement saying Spotify should be more specific about how and for which purposes it collects individuals' data.
The fine is the outcome of a four-year-long investigation by the agency based on complaints, including from Austrian privacy activist group NOYB, that invoked the General Data Protection Regulation's section on the individual right to access their personal data.
Spotify in an emailed statement said the investigation revealed that "only minor areas of our process" were at odds with the GDPR. "Spotify offers all users comprehensive information about how personal data is processed," the spokesperson said. "We don’t agree with the decision and plan to file an appeal," the spokesperson added.
In its 2019 complaint, NOYB alleged online streaming platforms, including Spotify, had failed to provide users all data on how their personal information was being processed. Authorities transferred jurisdiction over the complaint, originally filed in Austria, to Sweden since the company's European headquarters is located in Stockholm.
The investigation by the Swedish agency found that between November 2021 and May 2022, Spotify had processed users' personal data in violation of a requirement that companies be transparent on the purpose of personal data process, the types of recipients of personal data and whether protective measures are in place when personal data is transferred to third countries.
Although Spotify had necessary measures in place to inform its users regarding how their data is processed, the Swedish agency said the notification was "generalized," meaning that the company was providing the same information regardless of who requested the information.
The action from the Swedish authority comes after NOYB took to the Swedish courts to force a decision from IMY. That case is still under review.
"It is a basic right of every user to get full information on the data that is processed about them," Stefano Rossetti, privacy lawyer at NOYB, said.
Spotify has been given a deadline of one month to bring its existing data processing requirements into compliance.