Spotify faces music for data law breach, slapped with fine to tune of $5m
"Users have right to know what data company has about an individual and how that is being used," says IMY
June 13, 2023
Spotify was directed by Swedish authorities Tuesday to pay a sum of 58 million kronor ($5.4 million) for not informing its customers about how their collected data was utilised by the music streaming giant, however, the company is eyeing to challenge the decision.
The Swedish Authority for Privacy Protection (IMY) said it had reviewed "how Spotify handles customers’ right of access to their personal data."
"As a result of the shortcomings identified, IMY is imposing a fine of 58 million kronor on the company," the authority said.
The regulator noted that under the rules of the European data protection act GDPR, users have a right to know what data a company has about an individual and how that data is being used.
"While Spotify did hand out the data it had when requested by an individual, the company had not been sufficiently specific as to how that data was being used," IMY said.
"Since the information provided by Spotify has been unclear, it has been difficult for individuals to understand how their personal data is processed and to check whether the processing of their personal data is lawful," IMY noted.
It went on to add that the "shortcomings discovered are considered, overall, to be of low severity," motivating the size of the fine by Spotify's user count and revenue.
The music colossus is listed on the New York stock exchange and announced in April it crossed 500 million monthly active users with 210 million paying subscribers.
In response, Spotify rejected the findings, in a statement emailed to AFP that it "offers all users comprehensive information about how personal data is processed."
"IMY found only minor areas of our process they believe need improvement. However, we don't agree with the decision and plan to file an appeal," Spotify said.
“The fine followed a complaint and subsequent litigation from the group, and while they welcomed the decision they lamented the tardiness of the authorities, Privacy activist group Noyb said in a separate statement.
"The case took more than four years and we had to litigate the IMY to get a decision. The Swedish authority definitely has to speed up its procedures," Stefano Rossetti, a privacy lawyer said in the statement.
