Spotify fined $5M in Sweden for breach of data rules

The Swedish Authority for Privacy Protection, said in part earlier: The Swedish Authority for Privacy Protection, IMY, has audited how Spotify handles customers’ right to access their personal data. The deficiencies that have been discovered cause IMY to issue an administrative fine of SEK 58 million against the company. The General Data Protection Regulation, GDPR, entered into force in 2018 and means, among other things, that the rights of individuals are strengthened. One such right is the right of access, which means a right for individuals to find out what personal data a business handles about the person in question and to receive information about how this data is used.IMY has audited how Spotify handles the right for individuals to access their personal data. IMY assesses that Spotify releases the personal data the company processes when individuals request it, but that the company does not inform clearly enough about how this data is used by the company.The information that the company provides about how and for what purposes individuals’ personal data is handled should be more specific. It must be easy for the person requesting access to their data to understand how the company uses this data.. Spotify has taken several measures with the aim of meeting the requirements for individuals’ right to access, and the deficiencies that have been discovered are considered overall to be of a low level of seriousness. In light of that and, among other things, the number of registered users and Spotify’s turnover, IMY issues an administrative fine of SEK 58 million against Spotify for not having provided sufficiently clear information to individuals. Since Spotify has users in many countries, this decision has been made in cooperation with other data protection authorities in the EU.