Spotify fined over $5.4 million for breaking GDPR rules

There were allegations that the company failed to provide full information about personal data it processes in response to individual requests.

Published By: Om Gupta | Published: Jun 14, 2023, 04:14 PM (IST)

Spotify offers trending music and original podcasts with higher sound quality across all devices. It has songs from different genres, countries and decades. Spotify also offers premium service that offers ad-free music, group sessions and up to 10,000 songs download per device. It has a mini plan starting at Rs 7 per day and an individual plan at Rs 119 per month. It also has got a ‘Duo’ plan that has support for two accounts and is available for Rs 149 per month. The last Family plan, which is available for Rs 179 per month and has support for six accounts.

Highlights

Spotify failed to provide all personal data requested.
Spotify breached data access rights of users in the EU.
Spotify recently announced to lay off 200 employees.

Written By Om Gupta

Music streaming platform Spotify has been fined about $5.4 million in Sweden for breaching the data access rights of users in the European Union (EU).

There were allegations that the company failed to provide full information about personal data it processes in response to individual requests, which is a violation of Article 15 of the General Data Protection Regulation (GDPR), reports TechCrunch.

The complaint was filed at the start of 2019 by noyb, a privacy rights non-profit organisation.

According to the complaint, Spotify failed to provide all personal data requested, did not provide information on the purposes of the processing or recipients, and did not provide information on international transfers, among other allegations.

While the complaint was initially filed in Austria, the GDPR’s one-stop-shop mechanism, which is intended to streamline case handling when data processing crosses national borders, resulting in the complaint being routed to Sweden, where Spotify has its main EU presence.

The complaint then sat unresolved for several years, according to noyb, because the Swedish authority conducted a parallel ex officio investigation to which the complainants were not invited — despite the GDPR’s requirement that data controllers respond to access requests within a month, according to the report.

Due to the lack of a decision, noyb ended up taking the Swedish data protection authority (IMY) to court.

Last year, it successfully challenged IMY’s position that the complainant is not a party in procedures, with the Stockholm administrative court ruling that complainants have the right to request a decision six months after the complaint was filed, the report mentioned.

Meanwhile, Spotify has announced to lay off 200 employees, 2 per cent of its workforce, from its podcast division as part of a corporate reorganisation.

–IANS