Spotify also fined: EUR 5 million

The Swedish data protection authority only took action against the company after a delay of four years and through court coercion.Allegation: Spotify allegedly failed to properly respond to requests to access data.

The Swedish data protection authority has ordered Spotify to pay the equivalent of around 5.03 million euros in fines. According to the authority, Spotify violated Article 15 of the General Data Protection Regulation (GDPR). In the specific case, the issue was how Spotify handled personal data and how customer access to this data was regulated.

The Integritetsskyddsmyndigheten (IMY) found that although Spotify provided users with personal data upon request, it “did not provide clear enough information about how this data was used by the company.” Spotify needs to be more transparent about “how and for what purposes users’ personal data is processed,” the agency demands.

According to IMY, the lack of transparency and comprehensibility ensured that “it was difficult for individuals to understand how their own personal data was processed.” As a result, Spotify made it difficult for customers to “verify whether the handling of their own persona