1(5)
Notice: This document is an unofficial translation
of the Swedish Authority for Privacy Protection’s
(IMY) decision 2021-11-22, no. DI-2020-10533.
Only the Swedish version of the decision is
deemed authentic.
Our ref.:
DI-2020-10533, IMI no. 115756 Supervision under the General Data
Date of decision: Protection Regulation – Spotify AB
2021-11-22
Date of translation:
2021-11-30
Final decision of the Swedish Authority for
Privacy Protection (IMY)
The Swedish Authority for Privacy Protection (IMY) finds that Spotify AB has
processed personal data in violation of
Article 12(3) and 15 of the General Data Protection Regulation (GDPR) 1 by
not giving the complainant access to her personal data in accordance with her
request of 26 December 2018 no earlier than 3 June 2021,
Article 12(2) of the GDPR by not having facilitated the exercise of the
complainant’s right pursuant to Article 16 to have her information on home
address corrected in accordance with her request of 25 December 2018 and
instead referred her to create a new account on the company’s music service,
and
Article 12(3) and 16 of the GDPR by not granting the complainant’s request
for rectification of her home address of 25 December 2018 without undue
delay through it having been rectified on 17 October 2019.
The Swedish Authority for Privacy Protection (IMY) issues Spotify AB a reprimand in
accordance with Article 58(2)(b) of the GDPR for infringement of article 12(2), 12(3),
15 and 16.
Report on the supervisory matter
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Spotify AB (Spotify or the Company) due to a complaint. The complaint has been
submitted to IMY, in its capacity as lead supervisory authority pursuant to Article 56 of
Postal address:
Box 8114 the GDPR, from the supervisory authority of the country where the complaint has been
104 20 Stockholm lodged (Germany). The handover has been made in accordance with the provisions of
Sweden the GDPR on cooperation regarding cross-border processing.
Website:
www.imy.se
E-mail:
[email protected] 1
Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with respect to the processing of
Telephone: personal data and on the free flow of such data and repealing Directive 95/46/EC (General Data Protection
+46 (8) 657 61 00 Regulation).
Swedish Authority Our ref.: DI-2020-10533, IMI no. 115756 2(5)
for Privacy Protection Date: 2021-11-22
The investigation has been carried out through written correspondence. In the light of
cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR. The supervisory authorities
concerned have been the data protection authorities in Belgium, Ireland, the
Netherlands, Germany, Denmark, Italy, Cyprus, Portugal, France, Austria, Finland,
Norway, Luxembourg, Slovakia, Hungary, Spain and Poland.
The complaint
The complaint essentially states the following. The complainant’s request to change
the address of her account on the company’s music service has been denied. The
company’s customer service has stated that it is not possible to change the addresses
of accounts and that the solution is to delete the account and open a new account. The
complainant has requested to have her data rectified and holds that it should not be
necessary to delete her account and open a new one to obtain rectification.
Furthermore, the complainant has requested access to her personal data. None of the
requests has been met.
What Spotify has stated
Spotify has mainly stated the following.
Spotify received a request from the complainant to update the complainant’s home
address on 25 December 2018. The request was answered on 26 December 2018.
The company then informed the complainant that updating the address on the existing
account (family account) was not technically feasible, but that a new account with the
correct address could be created to solve the problem. Spotify would then have
created a new account free of charge, and Spotify’s customer service team would
have transferred all content, such as playlists, followers and account information to the
new account. However, this solution was rejected by the complainant.
Since then, Spotify has developed a new version of Family Accounts, allowing the user
to change their own address instead of involving customer service and transferring the
account. The complainant was transferred to the new version, in which the address
can be changed by the user in the account settings, on 18 September 2019,
whereupon the complainant updated to her new address on 17 October 2019.
Spotify holds that the company took the necessary steps to satisfy the complainant’s
request on 26 and 27 December 2018, by explaining that it was not technically
possible in the version of the family account that existed at the time and instead
offered an alternative solution to the problem.
Spotify received the complainant’s request for the exercise of the right to access on 26
December 2018. Spotify’s customer service responded to the complainant on
December 26, 2018 and referred the complaint to Spotify’s Privacy Centre. That is an
online service, which provides standard information about Spotify’s personal data
processing and how individuals can exercise their data protection rights, with a link to
Spotify’s tool “Download Your Data”. However, Spotify’s information shows that the
complainant did not use the “Download your data” tool or made further requests to
access her personal data.
According to Spotify’s standard process, the customer service advisor should have
directly addressed the complainant’s request for access instead of referring the
complainant to the company’s Privacy Centre. In reviewing the correspondence with
the complainant, it seems that the customer service advisor was primarily focused on
Swedish Authority Our ref.: DI-2020-10533, IMI no. 115756 3(5)
for Privacy Protection Date: 2021-11-22
answering the complainant’s request for rectification and failed to notice that it was
also a request for access and therefore did not respond to the request for access in
accordance with the company’s standard process. As part of the Spotify’s internal data
protection program, customer service is regularly trained in how they can identify and
appropriately act and escalate requests from data subjects. In this case, the customer
service advisor made a mistake.
Due to the above, the complainant did not get access to her personal data in
accordance with her request on 26 December 2018.
Spotify contacted the complaint on 3 June 2021 regarding her request for access and
informed her that her personal data had been made available for download. However,
the complaint has neither downloaded them nor responded.
Justification of the decision
Applicable provisions
According to Article 12(2), the controller shall facilitate the exercise of data subject
rights under Articles 15-22. According to Article 12(3), the controller shall provide
information on action taken on a request under Articles 15 to 22 to the data subject
without undue delay and in any event within one month of receipt of the request. That
period may be extended by two further months where necessary, taking into account
the complexity and number of the requests.
According to Article 15 of the GDPR, the data subject shall have the right to obtain
from the controller confirmation as to whether or not personal data concerning him or
her are being processed, and, where that is the case, access to the personal data and
the information stipulated in that article.
According to Article 16, the data subject shall have the right to obtain from the
controller without undue delay the rectification of inaccurate personal data concerning
him or her. Taking into account the purposes of the processing, the data subject shall
have the right to have incomplete personal data completed, including by means of
providing a supplementary statement.
The assessment of the Swedish Authority for Privacy
Protection (IMY)
Spotify has not handled the complainant’s request for access in accordance
with the GDPR
IMY finds that Spotify has not handled the complainant’s request for access of 26
December 2018 in accordance with the GDPR. It was not enough that Spotify
responded to the complainant’s request by referring to the company’s online service.
The fact that Spotify contacted the complainant first on 3 June 2021 and initiated the
process of disclosure of the complainant’s personal data cannot be considered to give
the complainant access to the information without undue delay according to the
GDPR. What Spotify has stated about it being a one-time occurrence due to an
oversight does not lead to any other assessment.
Against this background, IMY finds that Spotify AB has processed personal data in
violation of Articles 12(3) and 15 of the GDPR by not having without undue delay given
Swedish Authority Our ref.: DI-2020-10533, IMI no. 115756 4(5)
for Privacy Protection Date: 2021-11-22
the complainants access to their personal data in accordance with the complainant’s
request of 26 December 2018 no earlier than 3 June 2021.
Spotify has not handled the complainant’s request for rectification without
undue delay and has not facilitated the exercise of the complainant’s right to
request rectification in accordance with the GDPR
When the complaint requested to change her home address on 25 December 2018,
the company had no technical possibility to change the information in any way other
than if the complainant created a new account. However, IMY holds that the solution
offered by the company, i.e. that the complainant could create a new account where
the company would transfer the complainant’s information, was not sufficient for the
company to be deemed to have handled the request for rectification or have facilitated
the complaint’s exercise of her rights. The complainant’s address was only updated on
17 October 2019 and by her own agency, after the company had taken measures to
enable this on 18 September 2019.
IMY thus finds that Spotify AB has processed personal data in violation of Article 12(2)
GDPR by not having facilitated the complainant’s exercise of her right pursuant to
Article 16 to have her information on home address corrected and instead referred her
to create a new account on the company’s music service.
Furthermore, IMY finds that Spotify AB has processed personal data in violation of
Article 12(3) and 16 of the GDPR by not granting the complainant’s request to
rectification of her home address of 25 December 2018 without undue delay where by
rectification was made no earlier than 17 October 2019.
Choice of corrective measure
Articles 58(2) and 83(2) of the GDPR states that IMY has the authority to impose
administrative fines in accordance with Article 83. Depending on the circumstances of
the individual case, administrative fines shall be imposed in addition to or instead of
the other measures referred to in Article 58(2), such as injunctions and prohibitions.
Furthermore, Article 83(2) lists which factors should be taken into account in deciding
whether to impose an administrative fine and on the amount of the fine. If it is a minor
infringement, IMY may, as stated in recital 148 instead of impose an administrative
fine, issue a reprimand pursuant to Article 58(2)(b). Consideration shall be taken to
aggravating and mitigating circumstances in the case, such as the nature of the
infringement, severity and duration as well as previous relevant infringements.
IMY notes that the infringements affected one person, that it did not involve sensitive
data and that the company has not previously been found infringing the mentioned
articles except article 12(4) on June 8 2018.2 Furthermore, Spotify has now corrected
the information about the complainant’s home address, changed its procedure for
updating such data to facilitate data subject’s exercise of their rights in this regard and
on its own initiative taken measures to meet the complainant’s request for access.
Against this background IMY finds that it is to be considered as such minor
infringements in the sense referred to in recital 148 that Spotify AB shall be given a
reprimand pursuant to Article 58(2)(b) of the GDPR for the stated infringements.
2
IMY’s Decision 2021-03-24, case no. DI-2020-10541, available here
https://www.imy.se/globalassets/dokument/beslut/imy---final-decision-imy-di-2020-10541-imi-case-no-75661-spotify-
ab.pdf.
Swedish Authority Our ref.: DI-2020-10533, IMI no. 115756 5(5)
for Privacy Protection Date: 2021-11-22
This decision has been made by Head of Unit after presentation
by legal advisor .