The Swedish data protection authority only took action against the company after a delay of four years and through court coercion.Allegation: Spotify allegedly failed to properly respond to requests to access data.

The Swedish data protection authority has ordered Spotify to pay the equivalent of around 5.03 million euros in fines. According to the authority, Spotify violated Article 15 of the General Data Protection Regulation (GDPR). In the specific case, the issue was how Spotify handled personal data and how customer access to this data was regulated.

The Integritetsskyddsmyndigheten (IMY) found that although Spotify provided users with personal data upon request, it “did not provide clear enough information about how this data was used by the company.” Spotify needs to be more transparent about “how and for what purposes users’ personal data is processed,” the agency demands.

According to IMY, the lack of transparency and comprehensibility ensured that “it was difficult for individuals to understand how their own personal data was processed.” As a result, Spotify made it difficult for customers to “verify whether the handling of their own persona

This fine is a clear sign. The Irish data protection authority has fined tech giant Meta 1.2 billion euros for violating EU rules for years when transferring data to the US. Never before has a violation of the General Data Protection Regulation (GDPR) cost a company so much.

Facebook has been transferring data to the USA for over ten years without complying with EU regulations. Nevertheless, those responsible in the USA will understand the signal. Europe is serious about data protection. With the GDPR, the EU also has an instrument to punish violations in a way that hurts even the big players in the industry.

The US will now finally have to think about how it handles data. The cleanest solution would be for Joe Biden’s administration to change US laws to give Europeans the same rights as US citizens. Their data may only be spied on if a judge orders it. So far, the US has not been willing to do this.

However, it is not without a certain irony that Europe’s big moment comes from the initiative of a private individual. Austrian activist Max Schrems got the fine rolling with his complaints, just as he had previously brought down transatlantic arrangements for data transfers with lawsuits. Before European politicians display complacency on this day, they should ask themselves whether they have taken the admittedly unwieldy issue of data protection seriously enough. It is time to do so.

For the second year in a row, the current Allianz Risk Barometer shows that Swiss companies feel most at risk from cyber incidents, such as IT failures, ransomware attacks or data breaches. For your company, the question is not “if” it will be attacked, but “when”, by what means this will happen and how severe […]