1(30)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s decision in case
with national reference number, DI-2019-6696. Only the
Swedish version of the decision is deemed authentic
National case number:
DI-2019-6696 Final decision under the General Data
Protection Regulation — Spotify AB
Date:
2023-06-12
Table of contents
Decision of the Swedish Authority for Privacy Protection ...............................................3
Spotify AB’s general procedures for handling access requests ...........................3
Examination of individual complaints ...................................................................3
1 Presentation of the supervisory case ...........................................................................5
2 Applicable provisions ...................................................................................................6
3 Spotify AB’s general procedures for handling access requests - Grounds for the
decision ...........................................................................................................................7
3.1 Information — Article 15(1)(a) to (h) and (2) GDPR ......................................7
3.1.1 What Spotify AB has stated .............................................................7
3.1.2 Assessment by the Swedish Authority for Privacy Protection ..........8
3.2 Right of access to personal data and copy of personal data undergoing
processing — Article 15(1) and (3) GDPR .........................................................12
3.2.1 What Spotify AB has stated ...........................................................12
3.2.2 Assessment by the Swedish Authority for Privacy Protection ........15
4 Review of individual complaints — Grounds for the decision ....................................19
4.1 Complaint 1 (from the Netherlands with national reference number z2018-
28415) ................................................................................................................19
4.1.1 Background ....................................................................................19
4.1.2 What Spotify AB has stated ...........................................................20
4.1.3 Assessment by the Swedish Authority for Privacy Protection ........21
Mailing address:
4.2 Complaint 2 (from Austria with national reference number D130.198) ........22
Box 8114
104 20 Stockholm 4.2.1 Background ....................................................................................22
Website:
4.2.2 What Spotify AB has stated ...........................................................23
www.imy.se
E-mail: 4.2.3 Assessment by the Swedish Authority for Privacy Protection ........24
[email protected]
4.3 Complaint 3 (from Denmark with national reference number 2018-31-1198)
Phone: ...........................................................................................................................25
08-657 61 00
Privacy Protection Authority Registration number: DI-2019-6696 2(30)
Date: 2023-06-12
5 Choice of corrective measure ....................................................................................26
5.1 Applicable provisions ...................................................................................26
5.2 Same or linked data processing...................................................................26
5.3 Infringements relating to the information pursuant to Article 15(1) and (2)
GDPR and to the description of the data in the technical log files .....................27
5.4 Infringements relating to complaints 1 and 2 ...............................................29
Privacy Protection Authority Registration number: DI-2019-6696 3(30)
Date: 2023-06-12
Decision of the Swedish Authority for Privacy
Protection
Spotify AB’s general procedures for handling access requests
The Swedish Authority for Privacy Protection finds that, during the period from 16
November 2021 to 16 May 2022, in the information to be provided pursuant to Article
15(1) and (2) of the General Data Protection Regulation (GDPR)1, Spotify AB (556703-
7485) did not provide sufficiently clear information on:
– the purposes of the processing,
– the categories of personal data concerned;
– categories of recipients of the personal data;
– the envisaged period for which the personal data will be stored or, if not possible,
the criteria used to determine that period;
– the source of personal data;
– appropriate safeguards when personal data are transferred to third countries.
The Swedish Authority for Privacy Protection further finds that Spotify AB, during the
period from 11 June 2019 to 16 May 2022, by providing by default the description of
the data in the technical log files in English, has not complied with the requirement that
all communications provided to the data subject pursuant to Article 15 of the GDPR
shall be clear and intelligible as set out in Article 12(1) of the GDPR.
Spotify AB has thus processed personal data in breach of Articles 12(1), 15(1)(a) to
(d), 15(1)(g) and 15(2) of the GDPR.
Pursuant to Articles 58(2) and 83 of the GDPR, the Swedish Authority for Privacy
Protection decides that Spotify AB shall pay an administrative fine of 58,000,000 (fifty-
eight million) SEK for these infringements.
Examination of individual complaints
The Swedish Authority for Privacy Protection finds with regard to complaint 1 that in its
handling of the complainant’s request for access made on 27 May 2018, Spotify AB
has processed personal data in violation of:
– Article 12(3) of the GDPR, by late submission of the copy of personal data;
– Articles 12(1), 15(1) and 15(3) of the GDPR, by not having provided all the
complainant’s personal data in an intelligible form in the copy of personal data
provided by Spotify AB.
The Swedish Authority for Privacy Protection finds with regard to complaint 2 that in its
handling of the complainant’s request for access made on 10 October 2018, Spotify
AB has processed personal data in violation of:
– articles 15(1) and 15(3) of the GDPR, by not having given access to all personal
data that Spotify AB processed about the complainant in the copy of personal data
provided by Spotify AB;
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation).
Privacy Protection Authority Registration number: DI-2019-6696 4(30)
Date: 2023-06-12
– articles 15(1)(a) to (h) and 15(2) GDPR, by not providing any of the information
specified in these provisions.
The Swedish Authority for Privacy Protection issues a reprimand to Spotify AB
pursuant to Article 58(2)(b) of the GDPR for the infringements relating to complaints 1
and 2.
Pursuant to Article 58(2)(c) of the GDPR, the Swedish Authority for Privacy Protection
orders Spotify AB to comply with the complainant’s request for access in respect of
complaint 2. This is done by providing the complainant access to all personal data that
Spotify AB processes regarding the complainant, with exception for information which
is subject to any applicable derogation provided for in Article 15(4) of the GDPR and
Chapter 5 of the Data Protection Act2, by providing the complainant with a copy of the
personal data pursuant to Article 15(3) of the GDPR and provide information pursuant
to Articles 15(1)(a) to (h) and 15.2 of the GDPR. This measure shall be implemented
no later than on month after this decision has become final.
2 Act containing supplementary provisions to the EU General Data Protection Regula ion (SFS 2018:218).
Privacy Protection Authority Registration number: DI-2019-6696 5(30)
Date: 2023-06-12
1 Presentation of the supervisory case
Due to complaints that the Swedish Authority for Privacy Protection (IMY) has received
against Spotify AB regarding the right of access pursuant to Article 15 of the GDPR,
IMY has initiated supervision against Spotify AB in order to investigate whether Spotify
AB’s way of handling the data subject’s request for access is in accordance with the
provisions of the GDPR. IMY has initially examined Spotify AB’s general procedures
when handling access requests and not the circumstances in the individual complaints.
The investigation has focused on whether Spotify AB’s processes and procedures for
providing access under Article 15 of the GDPR generally enable data subjects to
access the personal data Spotify AB processes about them and other information
under the provision. In this context, “data subject” refers to customers who use Spotify
AB’s services and no other categories of data subjects, e.g. employees of Spotify AB.
IMY has not, in this investigation, verified what personal data Spotify AB processes
and whether all these are disclosed at each individual request. For example, no
comparison has been made between Spotify AB’s records of processing pursuant to
Article 30 of the GDPR and the personal data contained in the copy of personal data
pursuant to Article 15(3) of the GDPR. In the context of this investigation, IMY has also
not examined whether Spotify AB’s personal data processing otherwise complies with
the provisions of the GDPR, e.g. regarding principles and legal basis for the
processing.
IMY initiated the supervisory case by sending a questionnaire on 11 June 2019. Reply
to the questionnaire was received on 31 July 2019. On 16 October 2019, a request for
additional information on the case was sent to Spotify AB. A reply was received on 15
November 2019. Spotify AB has subsequently submitted further additions on 25
August 2020 on its own initiative in order to inform IMY of updates regarding
procedures for handling requests for access.
Spotify AB is an organisation with operations and users in several EU Member States.
Due to the cross-border nature of the case, IMY has applied the cooperation and
consistency mechanisms provided for in Chapter VII of the GDPR. All data protection
authorities in the EU have been concerned supervisory authorities in this case. With
regard to the cooperation and consistency mechanisms, and the need for harmonised
complaint handling within the EU3, IMY extended in November 2020 the ongoing
general oversight to cover also the three individual complaints, which also include the
complaints which initially led to the investigation of the general procedures.
On 5 November 2020, IMY requested Spotify AB to state its position on the
infringements alleged in the complaints and what measures Spotify AB had taken to
respond to the respective requests for access. Spotify AB replied to IMY’s request on
18 December 2020. Spotify AB subsequently submitted additional information, on 15
April 2021 in response to additional questions sent by IMY on 24 March 2021 and 31
August 2021 in response to questions sent by IMY on 9 July 2021.
On 19 October 2021, a further request for additional information was sent regarding
Spotify AB’s general procedures. A reply was received on 12 November 2021. On
3 In 2020, DPAs worked jointly to establish common approaches to the handling of complaints, resulting in an internal
guidance established in February 2021. From the fact that the authority previously used complaints to identify
recurring patterns and risks, but as a general rule closed the complaints with a standard response, IMY now makes
an individual assessment of each complaint. Internal EDPB Document 02/2021 on SA’s duties in relation to alleged
GDPR infringements, adopted 2 February 2021.
Privacy Protection Authority Registration number: DI-2019-6696 6(30)
Date: 2023-06-12
June 8 and October 17, 2022, Spotify AB has, on its own initiative, submitted further
additions in order to inform IMY of updates regarding their procedures for handling
requests of access.
Spotify has expressed its views on IMY’s draft decision on 20 December 2022. IMY
then gave the concerned supervisory authorities the opportunity to give their opinion in
accordance with Article 60 of the GDPR. The French Data Protection Authority has
raised a relevant and reasoned objection to the IMY’s draft decision. Spotify has been
given the opportunity to comment on the objection on 13 March 2023 as well as on the
revised draft decision shared by IMY. Spotify’s response was received on 11 April
2023.
Hence, as described above, the supervisory case consists of an investigation of
Spotify AB’s general procedures for handling requests of access and, also, an
investigation of what has occurred in the three complaints. The general procedures
that Spotify AB used to provide personal data pursuant to Article 15(1) and (3) of the
GDPR covered by IMY´s supervision where those in force from the start of IMY’s
supervision on 11 June 2019 until 16 May 2022. As regards the information pursuant
to Article 15(1) and (2) of the GDPR to be provided in the event of a request of access,
Spotify AB has updated it several times since the start of IMY´s supervision. IMY has
therefore limited its investigation to the information provided during the period from 16
November 2021 to 16 May 2022.4
2 Applicable provisions
Pursuant to Article 15(1) of the GDPR, the data subject has the right to obtain from the
controller confirmation as to whether or not personal data concerning him or her are
being processed and, if so, to have access to the personal data and the following
information:
a) The purposes of the processing;
b) The categories of personal data concerned;
c) The recipients or categories of recipient to whom the personal data have been
or will be disclosed, in particular recipients in third countries or international
organisations;
d) Where possible, the envisaged period for which the personal data will be stored,
or, if not possible, the criteria used to determine that period;
e) The existence of the right to request from the controller rectification or erasure
of personal data or restriction of processing of personal data concerning the
data subject or to object to such processing;
f) The right to lodge a complaint with a supervisory authority;
g) Where the personal data are not collected from the data subject, any available
information as to their source;
h) The existence of automated decision-making, including profiling, referred to in
Article 22(1) and (4) and, at least in those cases, meaningful information about
the logic involved, as well as the significance and the envisaged consequences
of such processing for the data subject.
4 See Spotify AB’s information pursuant to Article 15 of the General Data Protection Regulation in Annex 2. The
information, which was downloaded by IMY on 16 May 2022, shows that the current website was last updated on 16
November 2021. The period of investigation is therefore set at the period from 16 November 2021 to 16 May 2022.
Privacy Protection Authority Registration number: DI-2019-6696 7(30)
Date: 2023-06-12
Article 15(2) of the GDPR states that where personal data are transferred to a third
country or to an international organisation, the data subject shall have the right to be
informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.
It follows from Article 15(3) of the GDPR that the controller shall provide the data
subject with a copy of the personal data undergoing processing. Furthermore, where
the data subject makes the request by electronic means, and unless otherwise
requested by the data subject, the information shall be provided, in a commonly used
electronic form.
Recital 63 of the GDPR states, as far as relevant, that:
A data subject should have the right of access to personal data which have
been collected concerning him or her, and to exercise that right easily and at
reasonable intervals, in order to be aware of, and verify, the lawfulness of the
processing. (...) Every data subject should therefore have the right to know and
obtain communication in particular with regard to the purposes for which the
personal data are processed, where possible the period for which the personal
data are processed, the recipients of the personal data, the logic involved in any
automatic personal data processing and, at least when based on profiling, the
consequences of such processing. (...)
In addition, it follows from Article 12(1) of the GDPR that the controller shall take
appropriate measures to provide any communication under Article 15 to the data
subject in a concise, transparent, intelligible and easily accessible form, using clear
and plain language.
It follows from Article 12(2) of the GDPR that the controller shall facilitate the exercise
of the data subject’s right of access under Article 15.
Pursuant to Article 12(3) of the GDPR, the controller shall provide information on
action taken on a request under Article 15 to the data subject without undue delay and
in any event within one month of receipt of the request. That period may be extended
by two further months where necessary, taking into account the complexity and
number of the requests. The controller shall inform the data subject of any such
extension within one month of receipt of the request, together with the reasons for the
delay.
3 Spotify AB’s general procedures for handling
access requests - Grounds for the decision
3.1 Information — Article 15(1)(a) to (h) and (2) GDPR
3.1.1 What Spotify AB has stated
Spotify AB has stated the following. Spotify AB provides information in accordance
with Article 15(1)(a) to (h) and Article 15(2) GDPR via an online function. This feature
is available in 21 different languages and visitors will automatically be given
information in languages based on language settings in their browser.
Data subjects exercising their right of access are informed of the function in several
ways. Each copy of personal data provided pursuant to Article 15(3) GDPR includes a
hyperlink to the information. The information can also be found online, partly in the list
Privacy Protection Authority Registration number: DI-2019-6696 8(30)
Date: 2023-06-12
of available features on Spotify AB’s “Privacy & Security” page, partly via the answer to
the question “Where can I find information about Spotify AB’s processing of personal
data that Spotify AB is obliged to provide pursuant to Article 15 of the GDPR?” on
Spotify AB’s “data rights and privacy settings” page.
In the information5 pursuant to Article 15 of the GDPR provided by Spotify AB during
the period from 16 November 2021 to 16 May 2022, Spotify AB provided, inter alia,
information on the purpose of processing (Article 15(1)(a)), the categories of personal
data processed (Article 15(1)(b), recipients or categories of recipients (Article 15(1)(c))
and the source of the personal data (Article 15(1)(g)). In addition, the Article 15
information also included information on international transfers (Article 15(2)), the
criteria for the retention of personal data (Article 15(1)(d), the rights of the data subject
(Article 15(1)(e), the right to lodge a complaint with the data protection authority
(Article 15(1)(f), automated decision-making (Article 15(1)(h)) and the possibility of
obtaining a copy of personal data.
In the information pursuant to Article 15 of the GDPR, Spotify AB also informed that
the processing of personal data is described in more detail in Spotify AB’s privacy
policy, which could also be accessed through a direct link. The privacy policy contains,
among other things, descriptions of the categories of personal data that Spotify AB
processes.
Spotify AB has stated that all questions that are not answered by the information
pursuant to Article 15 of the GDPR or which have not been explained to the user are
promptly escalated to Spotify AB’s data protection team. In this way, Spotify AB states,
the data protection team becomes aware of, and is given the opportunity to answer,
questions about clarifications or requests for more individualised information about the
processing of personal data pursuant to Article 15 of the GDPR.
3.1.2 Assessment by the Swedish Authority for Privacy Protection
IMY notes that Spotify AB’s function for information pursuant to Article 15 of the GDPR
during the period under review was available on several pages on Spotify AB’s
website. Furthermore, a link to the information was included in the “Read me first” file
attached to each copy of personal data provided to the data subject in accordance with
Article 15(3) GDPR upon a request of access. In view of the above, IMY considers that
Spotify AB’s procedures during the current period were sufficient to ensure that
information pursuant to Article 15 was provided to the data subject at any request for
access.
IMY further notes that Spotify AB’s information pursuant to Article 15 of the GDPR
covered all items of information that pursuant to Article 15(1)(a) to (h) and (2) of the
GDPR are to be provided to the data subject. However, in order for the information to
meet the requirements of the GDPR, the information must also be designed in such a
way that the purpose of the right of access is fulfilled.
The purpose of the right of access is for the data subject to be aware that processing
is taking place and to be able to verify that it is lawful, as stated in recital 63 of the
GDPR. For example, a data subject should be able to check which categories of data
are processed about him or her, for what purposes and for how long. In order for the
data subject to verify the lawfulness of the processing of personal data, he or she must
know which processing operations are relevant in his or her particular case. The
5 See Annex 2
Privacy Protection Authority Registration number: DI-2019-6696 9(30)
Date: 2023-06-12
information provided in this respect must be provided in a manner that meets the
transparency requirements of Article 12(1) of the GDPR.
In light of the purpose of the right of access, there is often a need to adapt the content
of the information under Article 15(1) and (2) of the GDPR to the data subject who has
made the request, for example depending on which of the controller’s services the
data subject has chosen to use. However, this does not apply to all parts of the
information. While the right to lodge a complaint with a supervisory authority (Article
15(1)(f) GDPR) does not change depending on who requests access, other data may
vary depending on the service the data subject uses, such as which categories of
personal data are processed, recipients and where personal data were collected. The
same applies to information on whether a transfer has taken place to a third country
and, if so, what appropriate safeguards have been taken during the transfer.
Therefore, in order for the data subject to be able to verify that the processing
concerning him or her is lawful, it is necessary, in accordance with the above, that
Spotify AB shall have taken steps to adapt the information to the specific situation of
the data subject.6
IMY notes that the information provided7 by Spotify AB pursuant to Article 15 of the
GDPR was provided in general terms. The same information was thus provided
regardless of who requested access under Article 15 of the GDPR. The information
was therefore not adapted on the basis of every request of access. However, Spotify
AB described when certain information was relevant to the data subject, such as “If
you use a third party service (...)”, “If you choose to pay for a service or function by
invoice (...)” and “ In cases where you have given us permission (...)”. There were thus
some abilities for the data subject to determine which information was related to him or
her. There was also a possibility for data subjects to turn to Spotify AB and request
more individualised information as well as clarifications of the information provided.
IMY believes that such information provided in general terms may be appropriate for
standardised services involving personal data processing. However, in order for data
subjects to understand how their personal data are processed, it must always be
possible to clearly and easily determine which information is applicable in which
situations based on the information provided. This means that the possibility for the
data subjects to turn to Spotify AB for more individualised information as well as
clarifications do not affect the assessment of whether the information is sufficiently
clear in this respect. Generally drafted information shall not give rise to any ambiguity
as to whether the data subject is concerned by the information in question or not
based on his or her individual situation. IMY therefore has to examine whether the
information provided by Spotify AB met these requirements.
Information on categories of personal data, purposes, recipients and source
Information about the purposes of the processing shall relate to the purposes for which
the data subject’s personal data are actually processed, and may not consist merely of
a list of different purposes, without clarification what purposes relates to the person
requesting access. Furthermore, information on the categories of personal data
processed may need to be adapted to the circumstances of the data subject
requesting access. As regards the information of recipients or categories of recipients,
6 Cf. European Data Protection Board (EDPB) Guidelines on the right of access — Guidelines 01/2022 on data
subject rights — Right of access, version 2.0 (adopted on 28 March 2023), paragraph 113.
7 See Annex 2
Privacy Protection Authority Registration number: DI-2019-6696 10(30)
Date: 2023-06-12
such information should be as specific as possible. The controller should normally
state the actual recipients to whom the personal data have been or are to be
disclosed, unless this is impossible because, for example, there is not yet information
on who the recipients are. In addition, all available information as to their source of the
personal data shall be provided if the personal data have not been collected from the
data subject.8
As regards the information provided by Spotify AB about the purposes of the
processing, recipients of personal data and the source from which the data were
collected, IMY notes that the information was divided into different categories of
personal data. Those categories of personal data consisted of ‘user data’, ‘use data’,
‘plan verification data’, ‘voice data’, ‘payment data’ and ‘competition, survey and lottery
data’. The categories of personal data provided were generally held and, in several
cases, for example, in relation to “user data” and “use data” did not contain any further
description of which personal data could be included. IMY considers, especially given
the absence of a clear description of the categories in question, that it was not possible
for data subjects to understand, on the basis of the information provided, which
personal data were included in the different categories. Since the information on
purposes, recipients and source was divided into those categories of personal data,
this shortcoming had the effect that it was also not possible for data subjects to easily
understand which personal data were processed for what purposes, which personal
data were obtained from what source or which personal data were provided to a
particular recipient or category of recipients. Data subjects have thus not been able to
determine how their personal data were processed.
IMY therefore considers that Spotify AB has not provided sufficiently clear information
about the purposes of the processing (Article 15(1)(a) GDPR), the categories of
personal data concerned (Article 15(1)(b) GDPR), recipients or categories of recipients
(Article 15(1)(c) GDPR) or the source from which the data were collected (Article
15(1)(g) GDPR). The information was not concise, and transparent, nor easily
accessible. It therefore did not meet the requirements of Article 12(1) of the GDPR.
Information about the retention period
Information provided on how long personal data is stored shall be sufficiently specific
to enable the data subject to understand how long his or her personal data will be
stored. If it is not possible to specify the envisaged period for which the data will be
stored, the relevant event affecting that period should instead be specified, such as the
expiry of a guarantee period. The retention periods shall relate to the personal data
relating to the data subject requesting access. Where these personal data are subject
to different retention periods, information on the retention periods shall be given in
relation to each relevant data processing and category of personal data.9
Spotify AB provided information on retention periods under the heading “Criteria for the
retention of personal data”. The information contained general information about the
purposes for which the personal data are stored and the criteria used to determine the
retention periods. It was stated, inter alia, that personal data is retained by default for
90 days, unless a longer period is chosen due to a legitimate business reason. In
addition, it was stated that personal data is stored for an appropriate period to deliver a
8 Cf. European Data Protection Board (EDPB) Guidelines on the right of access — Guidelines 01/2022 on data
subject rights — Right of access, version 2.0 (adopted on 28 March 2023), point 114-120 and the judgement of the
CJEU on 12 January 2023 in Case C-154/21 Österreichische Post.
9 European Data Protection Board (EDPB) Guidelines on the right of access — Guidelines 01/2022 on data subject
rights — Right of access, version 2.0 (adopted on 28 March 2023), paragraph 118.
Privacy Protection Authority Registration number: DI-2019-6696 11(30)
Date: 2023-06-12
personal service over time and that streaming history is usually retained over the
lifetime of an account.
The information on how long data is retained was provided in general terms and, with
the exception of, inter alia, the information on streaming history, not clearly linked to
the categories of personal data covered by the different retention periods. The data
subjects were therefore unable to determine which of their personal data was retained
for what period of time. Furthermore, the criteria for determining the retention period
set out in the information were, in some cases, very imprecise. For example, it is
difficult for a data subject to understand what was included in “legitimate business
reasons” and thus in what situations personal data was retained for more than 90 days
or what it meant that streaming history was “usually” kept over the lifetime of an
account.
In an overall assessment, IMY considers that the information provided concerning
retention periods did not meet the requirements of Article 15(1)(d) of the GDPR, both
because the information in this part was set out in general terms and not related to the
relevant category of personal data, and partly because some of the criteria used to
determine the retention period were too imprecise to enable the data subject to
understand how long his or hers personal data were stored. The information was not
concise and transparent, nor easily accessible. It therefore did not meet the
requirements of Article 12(1) of the GDPR.
Information on third country transfers
In order for the data subject to be able to assess whether a possible transfer of his or
her personal data to a third country is lawful, the data subject must be provided with
meaningful information enabling it to be ascertained whether his or her personal data
have been transferred and, if so, what safeguards have been used. In order to enable
the data subject to verify whether his or her personal data have been lawfully
processed, the information should normally also state to which third countries the
transfer has taken place.10
The information provided by Spotify AB regarding transfers to third countries under the
heading “International Transfers” showed that Spotify AB may share personal data
globally with other companies in Spotify Group, service providers, partners, etc.
Furthermore, it was stated that Spotify AB ensures that the transfer is carried out in
accordance with applicable data protection and confidentiality laws and that technical
and organisational measures, and in particular appropriate safeguards, are applied,
such as the standard contractual clauses approved by the European Commission
when personal data are transferred from the European Economic Area (EEA).
IMY notes that the information provided by Spotify AB regarding third country transfers
was given in general terms and not linked to the data subject’s own situation. In that
regard, it was not clear whether the personal data of the data subject had been
transferred to a third country and, if so, what appropriate safeguards had been taken
during the transfer. In addition, it was not clear to which third countries transfers had
taken place. IMY therefore considers that the information provided regarding third
country transfers did not meet the requirements of Article 15(2) GDPR. The
10 Cf. Article 29 Guidelines on Transparency under Regulation (EU) 2016/679, WP260rev.01, adopted by he
European Data Protection Board, p. 40
Privacy Protection Authority Registration number: DI-2019-6696 12(30)
Date: 2023-06-12
information was not concise and transparent, nor easily accessible. It therefore did not
meet the requirements of Article 12(1) of the GDPR.
Summary assessment of the information pursuant to Article 15(1) and (2) GDPR
In conclusion, IMY finds that the information provided by Spotify AB pursuant to Article
15(1) and (2) of the GDPR during the period from 16 November 2021 to 16 May 2022
has been deficient in the above-mentioned respects. Spotify AB has thus processed
personal data in breach of Articles 12(1), 15(1)(a) to (d), 15(1)(g) and 15(2) of the
GDPR.
3.2 Right of access to personal data and copy of personal data
undergoing processing — Article 15(1) and (3) GDPR
3.2.1 What Spotify AB has stated
Spotify AB has stated that its response to the request for access, with a few
exceptions, is designed to disclose all personal data that they process in relation to the
data subject. Spotify AB has also set out its procedures to ensure that all personal
data is disclosed, for example in the event of new or updated personal data
processing.
The copy of personal data provided by Spotify AB pursuant to Article 15(3) of the
GDPR can be provided through three different replies, Type 1, Type 2 and Type 3.
The personal data covered by Type 1 are profile information and the personal data that
Spotify AB has deemed to be of the greatest interest to the data subjects. Type 1
therefore includes the data subject’s playlists, streaming history and searches from the
last year, items saved in the data subject’s library, the number of followers the data
subject has, the number of users the data subject follows, the names of artists the data
subject follows, user data and payment information. In order to provide the data
subject with access to Type 1 information, Spotify AB has introduced a feature called
“Download Your Data” on a website for privacy settings. The website through which
the data subject can access this information is accessible to all customers through
their Spotify account and is provided in the same language as their Spotify Service.
Data subjects will have access to Type 1 information within about seven days. Data
subjects can also access the Type 1 information by contacting Spotify AB’s customer
service.
Type 2 information consists of technical log files stored in Spotify AB’s systems linked
to the data subjects’ user IDs. In order to access the Type 2 information, the data
subject may send a request via Spotify AB’s web form for privacy matters or by
contacting customer service or Spotify AB’s data protection officer through any other
channel (e-mail, Facebook, Twitter or letter). It takes about two to four weeks to
compile and provide this personal data.
Type 3 information is the information that a data subject specifically requests and may,
for example, relate to the data subject’s listening history at a certain date, an extended
listening history or a request for unstructured personal data, such as a request for a
particular email correspondence. Type 3 information can be requested in the same
way as Type 2 and such a request normally takes less than 30 days to process. In
case it takes longer to process the request, due to the complexity of the request, the
data subject is informed of the delay.
Privacy Protection Authority Registration number: DI-2019-6696 13(30)
Date: 2023-06-12
On June 15, 2021, Spotify AB has implemented changes whereby all Spotify users
who request a copy of personal data, in addition to what is available in the “Download
Your Data” tool, or who directly request a copy of all their personal data from Spotify
AB’s customer service, will have access to extended streaming history as well as
technical log file provided in one package.
Spotify AB has stated that the design of the process and its development to date are a
combined result of joint discussions, careful consideration and analysis, as well as
meetings with the relevant customer service and development teams. Spotify AB’s
data protection team has provided advice on legal requirements and best practices in
data protection and continues to update these on the basis of a number of identified
parameters, including relevant and up-to-date legislation, guidelines, the ability to
quickly respond to a large number of requests, user-friendliness and categories of
personal data processed.
Spotify AB has stated that it has over 232 million active users per month and that
during the period from 25 May 2018 to 30 June 2019, they responded to 753 575
requests for access. According to Spotify AB, the division of data into three different
types has made it possible to provide a quick and easy way for the data subject to
download the personal data likely to be most relevant to the data subject and to
generate responses on a large scale and with the speed required to satisfy the
majority of the data subjects.
Furthermore, Spotify AB refers to statements in the EDPB’s transparency guidelines11
that there is an inherent tension in the GDPR between the requirements to provide
data subjects with comprehensive information on the one hand and that the
information should be provided in a concise, clear, intelligible and easily accessible
form, on the other hand, the need to determine how to prioritize information that must
be given to data subjects, and what levels of detail and methods are appropriate for
conveying the information, and that the principle of transparency is an overarching
obligation. Spotify AB considers that these guidelines are relevant to the design of a
concise, transparent, easily understandable and easily accessible process for data
subjects to exercise their rights under Article 15 of the GDPR. By providing three
layers of responses to the request of access to data subjects, Spotify AB intends to
balance the interests of the GDPR correctly for the benefit of Spotify AB’s data
subjects. Spotify AB’s objective is to provide accurate information in accordance with
Article 15 to all data subjects at the right time by providing information in different
layers and in different ways.
Spotify AB states that it informed data subjects that it was possible to request access
to more personal data than those covered by Type 1 and Type 2, and that this
information was provided to data subjects before requesting access to their personal
data. Furthermore, Spotify AB stated that it was clear that data subjects could request
access to more personal data than those covered by Type 1 by requesting a Type 2
response. In addition, data subjects could contact Spotify AB’s customer service with
specific requests (so-called Type 3 request). The information about this is provided in
various ways, including on the “Personal data rights and privacy settings” website and
on the website where information pursuant to Article 15 of the GDPR is published.
Furthermore, when a user requests access to the personal data covered by Type 1 by
accessing “Download Your Data”, it is clear from the context that users have access to
a selection of their personal data and not all of their personal data. The “Download
your data” page also contains a reference to the website “Personal data rights and
11 Article 29 Working Party’s Guidelines on Transparency under Regulation (EU) 2016/679, WP260rev.01, adopted by
he European Data Protection Board, paragraphs 1 and 34.
Privacy Protection Authority Registration number: DI-2019-6696 14(30)
Date: 2023-06-12
privacy settings”. In case of requests under both Type 1 and Type 2, information is
provided in accordance with Article 15 of the GDPR, which contains a comprehensive
description of the available data. The sources of information also explain that the user
can request access to their personal data via customer service or by contacting Spotify
AB via email. If a user contacts Spotify AB’s customer service to exercise the right of
access pursuant to Article 15 of the GDPR, customer service can explain all three
types of personal data available and inform users of the additional information
available. The data subjects were also informed that they could request access to
more personal data than they have already downloaded on the website “Understand
my data”.
In addition, during the course of the case, Spotify AB has updated the information
addressed to the data subjects in order to make it more transparent for data subjects
that there is more to request than is available in the “Download your data” tool.
With regard to the clarity of the information, Spotify AB has stated, in essence, the
following. In designing the format for responding to access requests, Spotify AB
focused on providing all information in a way that makes it relevant, transparent and
helpful to the data subjects. Spotify AB developed a procedure to ensure that the
descriptions of the personal data are accurate and complete, which included extensive
efforts to translate technical information into a simple language that can be understood
by an average customer, without removing the details required for transparency. In
order to facilitate understanding, Spotify AB does, among other things, the following.
– When downloading Type 1 information, the data subject also receives a so-called
“Read Me First” file. The “Read Me First” file contains a link to the website
“Understanding My Data”, which describes the format and personal data included
in Type 1. This page has been updated during the course of the case to include a
general description of the data in the technical log files and the extended streaming
history. The linked pages are automatically displayed in the customer’s preferred
language based on the language setting in the customer’s browser.
– Type 2 information, which consists of technical log files12, contains some
information that is highly technical in nature. In order to help data subjects
understand the formatting of the personal data, Spotify AB provides a detailed
description of the personal data in a specific file together with the data provided (in
a “Read Me First” file for the Type 2 request). This description is provided by
default in English. Spotify AB also answers customer questions about the
substance of the personal data provided, as part of its process for data subjects’
requests of access. Furthermore, Spotify AB continuously updates both the format
of technical log files related to the customer’s user ID (Type 2) and the
corresponding information in the Type2 “Read Me First” file to increase
transparency based on the questions asked.
– In the case of special enquiries (Type 3), when the personal data provided may
require explanations, Spotify AB may, if necessary, provide the information in an
email to the data subject together with the copy of the personal data.
Spotify AB has stated the following as a background to the fact that the description of
the Type 2 data by default is provided in English. To ensure that the information
provided by Spotify AB to the data subjects is correctly translated into their local
language, the files to be translated in manual translation are sent to professional
translators. Given that technical log data changes more dynamically over time than
other personal data collected, Spotify AB would have to send the comprehensive
“Read me First” file for translation several times a month. This would be
disproportionate and unreasonable to do for all local languages given the extra time,
12 From 15 June 2019, the Type 2 information includes, in addition to the technical log files, extended listening history.
Privacy Protection Authority Registration number: DI-2019-6696 15(30)
Date: 2023-06-12
resources and administration it would entail. Furthermore, many of the words that
appear in the technical log data do not typically have a translation because they often
reflect technical concepts that are mainly communicated in English and are usually not
translated into local languages. However, Spotify AB helps to translate the information
into local language if a user requests it to the extent that the technical terms are
possible to translate. Spotify has also stated that it has responded to approximately
340 000 requests for access to technical log files. Of those requests, only two data
subjects have turned to the company and requested a translation of the description
into their local language. Spotify further argues that translation of the technical log files
without a request would mean that all data subjects would have to wait longer for their
right to access the technical log files to be satisfied.
Regarding the format used, Spotify AB has stated that the personal data is provided in
JSON format, which according to Spotify AB is a structured and commonly used
format that can be understood by both computers and people. However, data provided
as a result of a Type 3 request is provided in the format necessary to respond to the
request.
On October 17 2022, Spotify AB informed IMY that Spotify AB has since that time
enabled data subjects to request access to account data, extended streaming history
and technical log files directly through the “Download Your Data” tool, i.e. without
contacting customer service. These procedures are not subject to IMY’s review as the
update has taken place after 16 May 2022.
3.2.2 Assessment by the Swedish Authority for Privacy Protection
Pursuant to Article 15(1) of the GDPR, the data subject has the right to obtain
confirmation as to whether the controller processes personal data concerning him or
her and, if so, to have access to the personal data. The controller is obliged, pursuant
to Article 15(3), to provide the data subject with a copy of the personal data
undergoing processing. The right of access is the same regardless of who the
controller is, but the way in which a request of access is handled may vary, depending,
inter alia, on the amount of the personal data processed and the number of data
subjects. Pursuant to Article 12(2) of the GDPR, the controller has an obligation to
facilitate the exercise of the data subject’s rights.
The purpose of the right of access is to make the data subject aware of the processing
carried out and to be able to verify that it is lawful. The controller must therefore ensure
that the copy of personal data provided contains all the personal data processed about
the data subject and is presented in a way that is comprehensible to the data subject.
Access to personal data must be provided in a manner that meets the transparency
requirements set out in Article 12(1) of the GDPR.
The requirements for the presentation and content of the copy means that controllers
who process a large amount of data or data which are particularly difficult to
understand may need to take specific measures when the information is presented to
data subjects.
Spotify AB, whose personal data processing is both extensive and complex, has
developed special procedures for handling access requests. The question is whether
these procedures enable Spotify AB to provide access to the personal data they
process in a way that satisfies the data subject’s right of access.
Dividing the copy of personal data into different layers
Privacy Protection Authority Registration number: DI-2019-6696 16(30)
Date: 2023-06-12
Spotify AB divides the copy of personal data into different layers, Type 1, Type 2 and
Type 3.
IMY considers that there is nothing that prevents dividing the copy of personal data as
long as the right of access is satisfied. On the contrary, it may, in certain situations,
make it easier for the data subject to comprehend the information if it is presented in
layers, at least in the case of a large amount of information. However, providing the
copy of personal data in different layers must neither restrict the right of access nor
complicate the exercise of the right of access. The controller must therefore take this
into account when assessing whether dividing the copy of personal data is an
appropriate measure.
A data subject who turns to a controller to request access to his or her personal data
normally lacks knowledge of which personal data are actually processed. Instead,
acquiring this knowledge is often the very purpose of the request. If, in this situation,
the controller only provides the data subject with a selection of his or her personal
data, the data subject may be led to believe that the copy provided is complete.
For this reason, IMY considers that the controller, in the channel it has established in
order for the data subject to request access, must be clear that the copy of the
personal data is divided into different layers. It shall also be clear to the data subject
what information is contained in the various layers and how the data subject can
access them.13
Spotify AB has stated that the data subject, in several different channels, receives
information that access to different personal data can be requested in different ways.
These channels show that access to “your most relevant personal data” can be
obtained through the “download your data” function and that access to technical log
files, extended streaming history or responses to other specific data protection
requests can be obtained upon request via email or customer service. IMY can, from
the examples set out in Spotify AB´s statement, note that the information provided to
data subjects also contains an overall list of the personal data covered by the different
types of requests.
IMY considers that the information provided by Spotify AB in this regard, during the
period covered by the review of the general procedures, is sufficiently clear to enable
the data subject to understand how the copy is divided, including what data are
contained in the different layers, and how the different layers can be requested.
Setting up specific conditions for the exercise of the right of access without it being
specifically regulated in the GDPR risks causing the data subject to be unduly
hindered in exercising their right. In other words, it may be unnecessarily difficult to
exercise the right, which in turn may result in the data subject refraining from
requesting all data to which the data subject is entitled. There is reason to underline
that, according to Article 12(2) GDPR, the controller has an obligation to facilitate the
exercise of the data subject’s rights. Therefore, in order to ensure that providing the
copy of personal data in different layers does not result in the restriction of the right or
that the exercise of the right is hindered, IMY considers that the data subject cannot be
required to return to the controller on several occasions in order to have access to all
personal data. Nor should it be complicated to request access to the various layers.
IMY therefore considers that the data subject should be able to request access to all
13 Cf. European Data Protection Board (EDPB) Guidelines on the right of access — Guidelines 01/2022 on data
subject rights — Right of access, version 2.0 (adopted on 28 March 2023), paragraph 146.
Privacy Protection Authority Registration number: DI-2019-6696 17(30)
Date: 2023-06-12
layers from the outset and that access to them should be easy. Notwithstanding that
the data subject, knowing how the data is divided, can still choose to request access to
only one or more layers.14
Spotify AB’s statement shows that the data subject can request access to the different
layers in different ways. It is not necessary for the data subject to return to Spotify AB
in order to access the various layers. However, the data subject may need to take
several steps to access multiple layers, e.g. by both downloading Type 1 information
through the “download your data” function and by requesting access to Type 2 and
Type 3 information through customer service. If the data subject addresses the request
directly to customer service, the data subject may request access to all personal data
at the same time.
IMY considers that the fact that the data subject must take different measures to
request the different layers of data may cause some inconvenience. However, the data
subject has the possibility to take all these s at one time. In addition, all measures can
be easily taken through Spotify AB’s website. In an overall assessment, IMY considers
that Spotify AB’s procedures enable the data subject to request access to all his or her
personal data in a sufficiently simple manner.
The presentation of the copy and the format of the copy
It follows from Article 12(1) of the GDPR that the information provided under Article 15
of the GDPR must be provided in a concise, transparent, intelligible and easily
accessible form using clear and plain language. The requirements for transparency in
the individual case must be assessed in the light of the purpose of the right of access,
i.e. that the data subject should become aware of the processing carried out and be
able to verify the lawfulness of the processing.
Most of the data that Spotify AB processes, especially when it comes to data in the
technical log files, is by its nature very technical because it contains e.g. codes and
numbers. For an average data subject, such data may be difficult to understand. IMY
considers that, providing such information without further explanation would not meet
the requirements of transparency, with regard to the purpose of the right. However,
since the data to be provided under Article 15(1) of the GDPR and covered by a copy
under Article 15(3) of the GDPR shall be the personal data processed, it is not
permitted for the controller to modify difficult personal data in order to facilitate
understanding. Such information may need to be explained instead.
Spotify AB provides further descriptions, together with the copy of personal data, in
order to make the data in the different layers understandable to the data subject.
Spotify AB also answers the data subject’s questions about the substance of the
personal data provided and updates its general procedures and descriptions based on
the questions asked.
IMY considers that the data in the technical log files provided by Spotify AB may be
complicated to understand, despite the descriptions provided by Spotify AB. However,
IMY considers that Spotify AB, by providing these descriptions, enables the data
subject, albeit with a certain amount of effort, to assimilate the information. The fact
that some effort may be required by the data subject to understand certain particularly
14 Cf. European Data Protection Board (EDPB) Guidelines on the right of access — Guidelines 01/2022 on data
subject rights — Right of access, version 2.0 (adopted on 28 March 2023) paragraph 146.
Privacy Protection Authority Registration number: DI-2019-6696 18(30)
Date: 2023-06-12
complex data, despite these descriptions, is a natural consequence of the nature of
those data.
By default, Spotify AB provides only the granular description of the data contained in
the technical log files in English. Neither Article 12(1) nor Article 15 of the GDPR
contains an explicit requirement as to the language or description of personal data to
be provided to the data subject. However, IMY considers that it follows from the
purpose of the right of access and the requirements for transparency set out in Article
12(1) that data subjects should be able to obtain the information in a language they
know, at least when the controller directs its activities to countries where it constitutes
an official language.15 This means that the controller must take sufficient steps to
ensure that the data subject understands the information.
Spotify AB provides the predominant proportion of information provided to data
subjects under Article 15 of the GDPR based on the language settings of the
individual’s web settings, i.e. the local language. This includes a general description of
the content of the technical logfiles. Furthermore, in the “Read Me First” file provided at
each request for access, Spotify provides clear information, in the local language, on
the possibility to request a translation of the description of the technical log files. This
information is also provided in the local language on the website “Understanding my
data”. Spotify AB has thus taken extensive measures to provide information in a
language that the data subject should be able to understand. However, it has reported
significant difficulties in translating the description of the data contained in the technical
log files into all the local languages of the countries to which it directs its activities. The
difficulties stem from the constant changes in the data in the technical log files and the
fact that many technical concepts are difficult to translate from English.
However, IMY notes that Spotify has stated that, at the request of a data subject, it has
the possibility to translate the description of the data in the technical log files into a
local language to the extent that the technical terms are translatable. As a translation
is therefore possible in practice, IMY considers that such a translation should be
available even before a request for translation has been made by a data subject.
Spotify’s stated difficulties in translating the description, including the fact that
translation may need to be done on several occasions each month and the additional
resources this requires, cannot justify that the description by default is being provided
in English. Having regard to the purpose of the right of access, it is essential that the
data subject understands which of his personal data have been processed in the
technical log files, which presupposes an intelligible description of its content. IMY
therefore considers that Spotify should have provided the description in the requester’s
local language already when the technical log files were provided to the data subject,
at least to the extent necessary for the understanding of the data in the technical log
files.
In view of the above, IMY considers that Spotify has not taken sufficient measures to
ensure that the data subject understands the description of the data in the technical
log files when this information is provided by default only in English. Therefore, the
information provided by Spotify in this part did not meet the requirement that all
communications provided to the data subject pursuant to Article 15 of the GDPR
should be clear and intelligible in the manner set out in Article 12(1) GDPR. The fact
15 Cf. Article 29 Guidelines on transparency under Regulation (EU) 2016/679, WP260rev.01, adopted by the
European Data Protection Board, paragraph 13 and the European Data Protection Board (EDPB) Guidelines on the
right of access — Guidelines 01/2022 on data subject rights — Right of access, version 2.0 (adopted on 28 March
2023) paragraph 142.
Privacy Protection Authority Registration number: DI-2019-6696 19(30)
Date: 2023-06-12
that a data subject has the opportunity to return to Spotify to request a translation does
not compensate this deficiency.
It follows from Article 15(3) of the GDPR that a data subject who makes a request for
access in electronic form shall receive the information in an electronic format that is
commonly used, unless the data subject requests otherwise. Spotify AB provides the
information in JSON format. The Guidelines on the right to data portability provide
JSON format as an example of a commonly used open format.16
IMY notes that the requirements for format are different for the right to data portability
and the right of access as data portability also requires the data to be provided in a
structured and machine-readable format pursuant to Article 20(1) of the GDPR. In light
of the purpose of the right of access, IMY considers that the format in which the data is
provided under Article 15 of the GDPR must be readable to a natural person.
However, there is nothing to prevent the format from being machine-readable as well.
Such a format can in many cases make it easier for the data subject to make various
compilations or comparisons himself in order to facilitate understanding. IMY considers
that JSON format, which can be read by both computers and natural persons, is
currently an electronic commonly used format within the meaning of Article 15(3)
GDPR.
Summary assessment regarding the right of access to personal data and copy of
personal data undergoing processing — Article 15(1) and (3) GDPR
In conclusion, IMY finds that Spotify AB’s way of dividing the copy of personal data into
different layers does not complicate the exercise of the data subjects’ rights and is
therefore in compliance with Article 12(2) of the GDPR and that the presentation and
format of the copy of the personal data largely comply with the transparency
requirements set out in Article 12(1) of the GDPR.
However, IMY finds that the description of the data contained in the technical log files
provided by Spotify during the period from 11 June 2019 to 16 May 2022 has not
complied with the requirements of Article 12(1) of the GDPR as this information has
been provided by default only in English. Spotify has therefore processed personal
data in this regard in breach of Article 12(1) of the GDPR during the period in question.
4 Review of individual complaints — Grounds
for the decision
4.1 Complaint 1 (from the Netherlands with national reference
number z2018-28415)
4.1.1 Background
In conclusion, the complainant submits that, with regards to his request of access
made on 27 May 2018, Spotify AB has not granted access to all his personal data
within the period laid down in Article 12(3) of the GDPR and that, once he has
obtained access to all personal data, it has not been provided in an intelligible form as
provided for in Article 12(1) of the GDPR.
16 Article 29 Working Party Guidelines on the right to data portability, WP242 rev.01, adopted by the European Data
Protection Board, p. 19.
Privacy Protection Authority Registration number: DI-2019-6696 20(30)
Date: 2023-06-12
4.1.2 What Spotify AB has stated
Spotify AB provides three types of responses to ensure an appropriate and complete
response to its users’ requests under Article 15 of the GDPR. It states that information
about all three types of responses (Type 1, Type 2 and Type 3) as well as information
on how to request access to them was available at the time of the complainant’s
request. When a user chose to download their data (Type 1), the description and
instructions given in connection with the download tool showed that this was only a
convenient way to get a copy of “most” personal data from his or hers account and
which categories of personal data were available through the tool. Based on the
context, it was therefore sufficiently clear that other personal data were also available.
The complainant also had the opportunity to contact customer service through a
number of channels and request additional personal data. The complainant had also
had the opportunity to turn to customer service and directly request access to all of his
personal data.
Spotify AB considers that the process at that time was sufficiently transparent to allow
users to understand and request additional available information in addition to those
included in the tool “Download Your Data”. Many other users also requested both Type
2 and Type 3 data at that time. The complainant also managed to request and access
both Type 1 and Type 2 information. Spotify AB has since made several improvements
in its processes to ensure that users cannot miss that there are three types of
information and how to easily request access to that information.
Spotify AB states that, as regards the provision of the complainant’s personal data, all
requested personal data were provided within the timeframe set out in Article 12(3) of
the GDPR. ‘Download your data’ (Type 1) was requested by the complainant on 27
May 2018. The data were made available and downloaded by the complainant on 28
May 2018. A response time of one day is consistent with Spotify AB’s goal of promptly
providing the most relevant information to users through their automated tools.
Technical log files (Type 2) were requested by the complainant by email on 11 June
2018. In Spotify AB’s reply on 6 July 2018, Spotify AB informed the complainant that
the provision of personal data would take a little longer than expected due to the high
number of requests and the complexity of compiling such technical information. The
information was made available for download on 17 July 2018. Even after informing
the complainant of the reason for the delay in replying, only 36 calendar days (26
working days) elapsed between the complainant’s request and the receipt of a reply.
As regards the complainant’s complaint concerning the format of the personal data,
Spotify AB stated that Type 2 data contains a large number of files containing technical
log data. The data processed may differ significantly for different users based on the
type of Spotify service plan they have (e.g. Free, Premium, Family), features and the
specific user’s activity, as well as variations in the usual internal processing and error
logging of Spotify AB´s software itself. It is a challenge to find a way to explain this
type of technical information in a way that the average Spotify user can understand.
At the time of the complainant’s request, Spotify AB provided the information in a
JSON format. However, it did not provide any additional documentation to further
clarify the types of data included and how it should be interpreted (in addition to the
information contained in the JSON data fields themselves). However, since 2019,
Spotify AB provides an additional “Read Me First” file upon delivery of all Type 2 data,
which further describes the information included in each file and data field. Given the
complexity and volume of the technical log files, the preparation of the “Read Me First”
Privacy Protection Authority Registration number: DI-2019-6696 21(30)
Date: 2023-06-12
file required a lot of work, and Spotify AB had not yet completed this process at the
time of the complainant’s initial request of access.
It was a mistake that the complainant was provided with some of the technical log files
in encrypted format. Spotify AB stores data in its systems in encrypted format in order
to enhance the integrity and security of Spotify AB’s own internal processing of
personal data. It was not Spotify AB’s intention to withhold the complainant’s personal
data from him. Although most encrypted data were decrypted before being included in
the complainant’s technical log files, some of the fields were not decrypted. This type
of problem was addressed in the discovery of this, and now the requested personal
data is always provided unencrypted.
Spotify AB would like to draw IMY’s attention to the fact that the complainant
requested his personal data again in July 2020. This request came after his complaint
to IMY and the improvements described above. The complainant received his personal
data much faster than within 30 days. The complainant requested “Download your
data” (Type 1) on 28 July 2020. Spotify AB provided the personal data three calendar
days later, on 31 July 2020. The complainant also requested its technical log files
(Type 2) on 3 August 2020 and downloaded the personal data when available 15 days
later, on 18 August 2020. Both of these requests were answered within a total of 18
days by Spotify AB and the complainant was able to receive all of its personal data
within a total of 21 calendar days. This timeframe is representative of Spotify AB’s
handling of these types of requests from users. All the technical information received
by the complainant on 18 August 2020 was unencrypted. The complainant should also
have received a “Read Me First” file explaining the data provided in every field. With
the fulfilment of the complainant’s most recent request, Spotify AB hopes that all of the
complainant’s questions regarding Articles 12(1) and 12(3) of the GDPR that he raised
in his complaint have been answered.
4.1.3 Assessment by the Swedish Authority for Privacy Protection
As IMY notes in the assessment of Spotify AB’s general procedures, section 3.2.2 of
this decision, it is possible to divide the copy of personal data into different layers
provided that the data subject has received sufficient information on, among other
things, how the copy of personal data is divided and how access to the different layers
can be requested.
The complainant’s claim that his personal data was not provided in due time shows
that the complainant must have considered that his initial request sent on 27 May 2018
encompassed all the personal data Spotify AB processed about him. Furthermore, it is
clear from the information provided by the complainant that he contacted Spotify AB
because he himself noted that the copy of personal data he received on 28 May 2018
was not complete. The fact that he contacted Spotify AB was therefore a consequence
of the conclusions made by the complainant himself on the basis of the copy of
personal data he received and not because the complainant understood Spotify AB’s
way of diving the copy of personal data and how access to additional information could
be requested. In IMY’s view, those circumstances imply that the information provided
by Spotify AB at the time of the complainant’s request concerning the way of dividing
the copy of personal data was not sufficiently clear.
Furthermore, IMY considers, when assessing the information provided by Spotify AB in
the description and instructions in connection with the complainant’s Type 1 request on
27 May 2018, that that information itself was not sufficiently clear to the complainant so
that he should have understood that only a subset of the personal data was covered
Privacy Protection Authority Registration number: DI-2019-6696 22(30)
Date: 2023-06-12
by the request. At the time of the complainant’s request, the information currently
available on Spotify AB’s website, inter alia, on the “personal data rights and privacy
settings” website, which lists the personal data provided in the various replies, and
how access to these can be requested, was also missing. IMY also considers that
Spotify AB´s argument that the complainant could turn to customer service and
request further information is irrelevant since such conduct presupposes that the
complainant would have understood that there was additional personal data that could
be provided.
In view of the above, IMY considers that, at the time of the complainant’s request of
access, Spotify AB did not provide sufficiently clear information to enable the
complainant to understand that the copy of personal data was divided. The existence
of sufficient information to enable a data subject to understand that his request relates
only to a selection of the personal data being processed is a prerequisite for the
controller to limit the disclosure to that personal data. Therefore, where it is unclear
whether the request concerns only a selection of the personal data, the controller
should assume that the data subject wishes to have access to all his or her personal
data. Therefore, since the information in that regard was inadequate at the time of the
complainant’s request, Spotify AB should have provided all the personal data which
they processed about the complainant at the time of his request of access made on 27
May 2018. The period within which Spotify AB had to provide the copy of all personal
data shall therefore be calculated from that date. Pursuant to Article 12(3) of the
GDPR, Spotify AB should have provided a full copy of the complainant’s personal data
or notified the complainant of an extension of the period by 27 June 2018. Spotify AB
did not notify the complainant until 6 July 2018 of an extension of the period of time.
The copy of the additional personal data was submitted on 17 July 2018. IMY notes
that Spotify AB has not notified the extension within the time prescribed in Article 12(3)
of the GDPR. Spotify AB has therefore provided the copy of the complainant’s
personal data too late.
The complainant’s information, confirmed by Spotify AB, shows that the additional
personal data he received on 17 July 2018 were difficult to understand and, in some
cases, encrypted.
As IMY notes in section 3.2.2, the controller is required to explain personal data that is
particularly difficult to understand in order to fulfil the purpose of the right of access.
IMY notes that Spotify AB has not complied with its obligations in the complainant’s
case since it has not provided an explanation of the personal data particularly difficult
to understand and since it has provided certain information encrypted.
In view of the above, IMY considers that in its handling of the complainant’s request for
access made on 27 May 2018, Spotify AB has processed personal data in breach of
Article 12(3) of the GDPR, by not having provided the copy of personal data in due
time, and in breach of Articles 12(1), 15(1) and 15(3) of the GDPR, by not having
provided all of the complainant’s personal data in an intelligible form.
4.2 Complaint 2 (from Austria with national reference number
D130.198)
4.2.1 Background
The complainant submits that, with regard to his request for access made on 10
October 2018, Spotify AB has not provided all the personal data it processes about the
complainant, that Spotify AB has not provided any of the information concerning the
Privacy Protection Authority Registration number: DI-2019-6696 23(30)
Date: 2023-06-12
processing of the complainant’s personal data required by Article 15(1)(a) to (h) and
(2) of the GDPR, and that Spotify AB has not provided the personal data in an
intelligible form as provided for in Article 12(1) of the GDPR. In that regard, the
complainant states, inter alia, that the data were provided in a format which is only
machine-readable and not comprehensible to natural persons.
4.2.2 What Spotify AB has stated
Spotify AB stated that the complainant requested access to the ‘Download Your Data’
(Type 1) on 10 October 2018. The data were made available and downloaded by the
complainant on 18 October 2018. The complainant then never contacted Spotify AB
again to present the views raised in his complaint to IMY. He also did not request
access to additional personal data other than those made available through the
“Download Your Data” tool.
Spotify AB provides three types of responses to ensure an appropriate and complete
response to its users’ requests under Article 15 of the GDPR. It states that information
about all three types of responses (Type 1, Type 2 and Type 3), as well as information
on how to request access to them, was available at the time of the complainant’s
request. When a user chose to download their data (Type 1), the description and
instructions given in connection with the tool showed that this was only a convenient
way to get a copy of “most” personal data from his or hers account and which
categories of personal data were available through the tool. Based on the context, it
was therefore sufficiently clear that other personal data were also available. The
complainant also had the opportunity to contact customer service through a number of
channels and request additional personal data.
Spotify AB considers that the process at that time was sufficiently transparent to allow
users to understand and request additional available information in addition to those
included in the tool “Download Your Data”. Many other users also requested both Type
2 and Type 3 data at that time. Spotify AB has since made several improvements in its
processes to ensure that users cannot miss that there are three types of information
and how to easily request access to that information.
At the time of the complainant’s request, the specific website with information pursuant
to Article 15(1)(a) to (h) and (2) of the GDPR had not yet been created and such
information was not automatically included in the response to the request for access.
Spotify AB confirms that the complainant did not receive this information together with
its Type 1 reply in October 2018. Spotify AB notes that although the complainant did
not receive the specific information pursuant to Article 15 in connection with his
request, the information was available to the complainant in Spotify AB’s privacy
policy.
Spotify AB further states that it had processes in place to provide additional
information and to take action in the event that its response would not be considered
sufficient to fully respond to a data subject’s request of access. If the complainant had
contacted [email protected] or Spotify AB’s customer service team regarding his
questions, they would happily provide additional personal data and other information
pursuant to Article 15 of the GDPR that he requested.
It is true that the complainant’s personal data provided through “Download Your Data”
tool was provided in JSON format. JSON is a recommended standard format that can
be understood by both people and computers. The information in “Download Your
Data” (Type 1) is largely self-explanatory based on the name of the file and fields.
Privacy Protection Authority Registration number: DI-2019-6696 24(30)
Date: 2023-06-12
Nowadays, however, Spotify AB also provides a detailed description of the data on the
information website “Understand my data”.
4.2.3 Assessment by the Swedish Authority for Privacy Protection
As IMY notes in the assessment of Spotify AB’s general procedures, section 3.2.2 of
this decision, it is possible to divide the copy of personal data into different layers
provided that the data subject has received sufficient information on, among other
things, how the copy of personal data is divided and how access to the different layers
can be requested.
The complainant, to IMY´s understanding, wanted to have access to all the personal
data Spotify AB processes about him. However, the complainant has only requested
access to the Type 1 data and has not returned to Spotify AB for further information. In
IMY´s view, the complainant’s conduct implies that the information provided by Spotify
AB at the time of his request concerning the way of dividing the copy of personal data
and how access to the various layers could be requested, was not sufficiently clear to
enable him to understand how to obtain access to all the data.
Furthermore, IMY considers, when assessing the information provided by Spotify AB in
the description and instructions in connection with the complainant’s Type 1 request on
10 October 2018, that that information itself was not sufficiently clear to the
complainant so that he should have understood that only a subset of the personal data
was covered by the request. At the time of the complainant’s request, the information
currently available on Spotify AB’s website, inter alia, on the “personal data rights and
privacy settings” website, which lists the personal data provided in the various replies,
and how access to these can be requested, was also missing. IMY also considers that
Spotify AB´s argument that the complainant could turn to customer service and
request further information is irrelevant since such conduct presupposes that the
complainant would have understood that there was additional personal data that could
be provided.
In view of the above, IMY considers that, at the time of the complainant’s request of
access, Spotify AB did not provide sufficiently clear information to enable the
complainant to understand that the copy of personal data was divided. The existence
of sufficient information to enable a data subject to understand that his request relates
only to a selection of the personal data being processed is a prerequisite for the
controller to limit the disclosure to that personal data. Therefore, where it is unclear
whether the request concerns only a selection of the personal data, the controller
should assume that the data subject wishes to have access to all his or her personal
data. Therefore, since the information in that regard was inadequate at the time of the
complainant’s request, Spotify AB should have provided all the personal data which
they processed about the complainant. IMY notes that Spotify AB has not provided all
the personal data they processed about the complainant. Spotify AB has therefore not
complied with the requirements of Articles 15(1) and 15(3) of the GDPR to grant the
data subject access to their personal data as Spotify AB has not provided the data
subject with a complete copy of the personal data that was being processed.
The complainant further states that the personal data to which he has been given
access were difficult to understand. It follows from Spotify AB’s statement that, at the
time of the complainant’s request, there was no description of the personal data
provided to the complainant (Type 1). However, IMY considers that the personal data
provided according to a Type 1 request is sufficiently clear to enable the average user
to understand the data and therefore does not require any further explanation. IMY
Privacy Protection Authority Registration number: DI-2019-6696 25(30)
Date: 2023-06-12
therefore considers that the personal data provided have been sufficiently clear to
comply with the requirements of Article 12(1) GDPR, i.e. that the information provided
under Article 15 of the GDPR should be provided in a concise, clear, intelligible and
easily accessible form using clear and plain language. There was therefore no
deficiency as to the clarity of the personal data provided to the complainant. However,
IMY welcomes the improvements made by Spotify AB after this point, which may
further increase the understanding of the personal data provided in Type 1 responses.
In addition, the complainant submits that his personal data were provided in a format
which was only machine-readable and not comprehensible to natural persons. Spotify
AB states that the data were provided in JSON format. IMY considers, as stated above
under 3.2.2, that JSON format, which can be read by both computers and natural
persons, is currently an electronic commonly used format as referred to in Article 15(3)
of the GDPR. IMY therefore considers that there was no deficiency in the format in
which the information was provided to the complainant.
Finally, the complainant claims that he did not receive information pursuant to Article
15(1)(a) to (h) and (2) of the GDPR. Spotify AB has confirmed that the complainant did
not receive this information together with the reply to the request submitted in October
2018. Spotify AB has therefore failed to fulfil its obligation to provide information under
Article 15(1)(a) to (h) and (2). The fact that at the time of the complainant’s request
information was available in Spotify AB’s privacy policy does not affect this deficiency.
In conclusion, IMY considers that in its handling of the complainant’s request for
access made on 10 October 2018, Spotify AB has processed personal data in breach
of Article 15(1) and (3) of the GDPR, by not having given access to all the personal
data that Spotify AB processed about the complainant and in breach of Article 15(1)(a)
to (h) and (2) of the GDPR, by not providing any of the information specified in these
provisions.
4.3 Complaint 3 (from Denmark with national reference number
2018-31-1198)
The complainant claims that Spotify AB has not responded to the complainant’s
request of access under Article 15 of the GDPR made on 12 November 2018.
The investigation in the case has not shown that Spotify has failed in its handling of the
complainant’s request for access, with the result that the complaint in question should
be rejected. The receiving supervisory authority, i.e. the Danish Data Protection
Authority, is therefore to adopt the decision with regard to this complaint under Article
60(8) GDPR. The reasons for that decision is therefore set out in a separate decision
adopted by the Danish Data Protection Authority.
Privacy Protection Authority Registration number: DI-2019-6696 26(30)
Date: 2023-06-12
5 Choice of corrective measure
5.1 Applicable provisions
In case of violations of the GDPR, IMY has a number of corrective powers, including
reprimand, injunctions and administrative fines. This follows from Article 58(2)(a) to (j)
of the GDPR.
IMY shall impose administrative fines in addition to or in place of other remedies
referred to in Article 58(2) GDPR, depending on the circumstances of each case.
If a controller or processor, with respect to one or the same or linked data processing,
intentionally or negligently violates several of the provisions of this Regulation, the total
amount of the administrative fine shall not exceed the amount determined for the most
serious infringement. This is stated in Article 83.3 of the GDPR. Each supervisory
authority shall ensure that the enforcement of administrative fines in each individual
case is effective, proportional and deterrent. This is stated in Article 83(1) of the
GDPR.
Article 83(2) states the factors to be taken into account in order to determine whether
an administrative fine should be imposed, but also what should affect the size of the
administrative fine.
The EDPB has adopted guidelines on the calculation of administrative fines under the
GDPR, which aim to create a harmonised methodology and principles for the
calculation of fines.17
5.2 Same or linked data processing
As stated above, IMY has, in the investigation carried out regarding Spotify AB’s
general processes and procedures for providing access pursuant to Article 15 of the
GDPR, found deficiencies in the information provided pursuant to Article 15(1)(a) to (h)
and (2) of the GDPR and in the description of the data in the technical log files
provided by Spotify. Furthermore, Spotify AB has failed in its handling of requests for
access relating to two of the complaints IMY has examined, complaint 1 and complaint
2.
The infringements related to the general procedures, relates, regarding the information
provided under Articles 15(1)(a) to (h) and (2), to the period from 16 November 2021 to
16 May 2022 and, regarding the description of the data in the technical log files, to the
period from 11 June 2019 to 16 May 2022. The requests for access covered by the
individual complaints were made on 27 May 2018 and 10 October 2018 respectively.
In this context, IMY assesses, inter alia, that the infringements related to the general
procedures and the infringements relating to the two complaints do not constitute the
same or linked processing operations within the meaning of Article 83(3) of the GDPR.
However, IMY considers that Spotify AB’s provision of information covered by Article
15(1) and (2) of the GDPR and the provision of the description of the data in the
technical log files is a linked processing. That assessment is made, inter alia, in the
light of the fact that the deficiencies found in those parts relate to the transparency
requirements of the information provided by Spotify to data subjects under Article 15 of
17 EDPB Guidelines 8/2020 Guidelines 04/2022 on the calculation of administrative fines under the GDPR.
Privacy Protection Authority Registration number: DI-2019-6696 27(30)
Date: 2023-06-12
the GDPR for a partially overlapping period of time. Furthermore, the complaints are
deemed to be linked.
IMY should therefore separately determine the choice of corrective measure for the
identified deficiencies in Spotify AB’s general procedures, i.e. in the information
pursuant to Article 15(1) and (2) of the GDPR and in the description of the data in the
technical log files, and for the findings concerning the two complaints.
5.3 Infringements relating to the information pursuant to Article
15(1) and (2) GDPR and to the description of the data in the
technical log files
IMY has considered that Spotify AB has infringed Articles 12(1), 15(1)(a) to (d),
15(1)(g) and 15(2) of the GDPR. Given, among other things, the fact that the
infringements have been able to potentially affect a large number of data subjects, that
the infringements have persisted over a long time and due to the fact that the
deficiencies in the information has made it difficult for data subjects to exercise their
other data protection rights, these are not minor infringements. Spotify AB should
therefore be subject to an administrative fine in respect of the infringements in this
part.
IMY notes that Spotify AB has infringed articles covered by Article 83(5) of the GDPR,
which means that a fine of up to EUR 20 million or four per cent of the global annual
turnover in the previous financial year, whichever is higher, can be imposed.
When determining the maximum amount for an administrative fine to be imposed on
an undertaking, an undertaking should be understood to be an undertaking in
accordance with Articles 101 and 102 TFEU (see recital 150 of the GDPR). The Court
of Justice’s case law states that this includes any entity engaged in economic
activities, regardless of the unit’s legal form and the way of its funding, and even if the
unit in a legal sense consists of several natural or legal entities.
IMY considers that the company´s turnover to be used as a basis for calculating the
administrative fines that can be imposed on Spotify AB, is Spotify AB’s parent
company Spotify Technology S.A.’s. Spotify Technology S.A.´s annual report for 2021
shows that the annual turnover in 2021 was approximately SEK 132 000 000 000. The
maximum administrative fine that can be determined in the case is 4 per cent of this
amount, i.e. approximately SEK 5 280 000 000.
In assessing the seriousness of infringements, IMY takes into account, in addition to
what is stated above, i.e. that the infringements have been able to potentially affect a
large number of data subjects, that the infringements have persisted over a long time
and that the deficiencies in the information have made it more difficult for data subjects
to exercise their other data protection rights, the following. The infringements have led
to a risk that the purpose of the right of access was undermined since the deficiencies
in the information provided have made it difficult for data subjects to understand which
of their personal data had been processed and how. The data subject has therefore
not been able to check whether the processing has been lawful. Spotify AB’s personal
data processing also includes a large amount of personal data about each data subject
and concerns many data subjects in several different countries.
However, as far as has been established, the data processed do not constitute special
categories of personal data as set out in Article 9 of the GDPR. The processing of
Privacy Protection Authority Registration number: DI-2019-6696 28(30)
Date: 2023-06-12
personal data carried out in the context of a customer relationship when providing a
music streaming service does not normally have significant consequences for the data
subjects. Furthermore, despite the scope of Spotify AB’s personal data processing,
IMY has received only a few complaints regarding Spotify AB’s handling of requests of
access.
It is also of significance that Spotify AB has a challenge in providing comprehensive
information about complex personal data processing in a way that is understandable to
the data subjects, which entails a difficult balancing act when assessing how the
information should best be presented. Spotify AB has provided some information in
accordance with Article 15(1) and (2) of the GDPR. Furthermore, Spotify AB has
provided information about its personal data processing on several pages on Spotify
AB’s website. Some information on how the personal data was processed has also
been possible to extract from the copy of personal data pursuant to Article 15(3) of the
GDPR that Spotify AB has provided to data subjects who requested access and which
IMY has deemed to largely comply with the requirements for clarity in Article 12(1) of
the GDPR.
The circumstances of the case further show that Spotify AB, on its own initiative and
before the current supervisory case was initiated, has taken several measures and put
extensive work on establishing, developing and improving procedures regarding
requests of access in order to be transparent to the data subjects. These processes
and procedures have since been continuously developed and improved. According to
IMY, this indicates that Spotify AB intends to fulfil the right of access in a way that is
transparent to the data subjects. Until last year, when the EDPB adopted guidelines on
the right of access18, detailed guidance on how to provide the information and the level
of detail, including the degree of individualization of the information to be provided
under Article 15(1) and (2) of the GDPR as well as which language should be used
when communicating under Article 15 GDPR, has also been missing.
Overall, considering the facts set out in this decision, IMY considers that the
infringements in question are of a low degree of seriousness. The starting point for
calculating the fine should therefore be set relatively low in relation to the maximum
amount in question. In order to ensure a proportionate fine in the individual case, it is
also necessary, at this stage, to further adjust the starting point for the further
calculation downward, taking into account the high turnover underlying the calculation
of the fine.
In addition to assessing the gravity of the infringement, IMY shall assess whether there
are any aggravating or mitigating circumstances that have a bearing on the amount of
the fine. The factors already taken into account in assessing the gravity of the
infringement cannot be taken into account again at this stage of the assessment.
IMY considers that there are no further aggravating circumstances affecting the
amount of the fine. As a mitigating circumstance, IMY places particular emphasis on
the possibility for the data subjects to contact Spotify AB’s customer service through
several different channels to obtain additional personalised information. In addition,
Spotify AB has informed in June 2022 that Spotify AB has made updates in the
information pursuant to Article 15, among other things, to enable the data subject to
understand the specific processing of personal data that is applicable to their unique
use of Spotify AB Service. As regards the infringements relating to Spotify’s choice of
18 European Data Protection Board (EDPB) Guidelines on the right of access — Guidelines 01/2022 on data subject
rights — Right of access, (adopted on 18 January 2022 for public consultation and finally adopted on 28 March 2023).
Privacy Protection Authority Registration number: DI-2019-6696 29(30)
Date: 2023-06-12
language for the description of the data in the technical log files, it is also important
that data subjects have had the opportunity to turn to Spotify to have the description
translated or explained in their local language and that Spotify provided clear
information about this possibility in the “Read Me First” file provided when the data was
provided to the data subject.
Considering the seriousness, aggravating and mitigating circumstances of the
infringements and the high turnover in relation to the infringements found, IMY
determines the administrative fine for Spotify AB to SEK 58 000 000. IMY considers
that this amount, which represents approximately 1 per cent of the maximum amount
of the administrative fine that can be determined in the present case, is effective,
proportionate and dissuasive in the present case.
5.4 Infringements relating to complaints 1 and 2
IMY has found that Spotify AB failed to fulfil its obligations vis-à-vis the complainants in
complaints 1 and 2. However, IMY notes that, in both cases, the complainants have
had access to some of their personal data in a timely manner. Furthermore, when the
complainant in complaint 1 contacted them, Spotify AB has been helpful in providing
further information and answering questions. Regarding complaint 2, Spotify AB has
not been made aware that the complainant considered that his request of access had
not been fully met. The complainant did not turn to Spotify AB to inform them that he
was dissatisfied with Spotify AB’s handling of his request of access, hence Spotify AB
had difficulties addressing the issue.
IMY notes that the current infringements did not involve sensitive personal data. In
addition, Spotify AB adopted measures, albeit inadequate, in order to comply with the
complainants’ requests. Therefore, even though the complainants’ right of access were
not fully complied with, the deficiencies which existed are less serious than if the
requests had been made unanswered.
IMY concludes from an overall assessment that, in relation to the infringements in
complaints 1 and 2, there are minor infringements and that there is therefore reason to
refrain from imposing a fine on Spotify AB for the infringements found in this part.
Spotify AB shall instead be subject to a reprimand pursuant to Article 58(2)(b) of the
GDPR.
Spotify AB states that it is willing to cooperate directly with the complainants in order to
ensure that it has provided all the personal data and information wanted by the
complainants and that it has answered their questions.
The complainant in complaint 1 reverted to Spotify AB in July 2020 and subsequently
obtained access pursuant to Article 15 of the GDPR. The complainant received all of
his personal data, including an explanatory document on the personal data processed,
within 21 days. The personal data provided at the time was unencrypted. Since the
complainant´s right of access has been satisfied, there is no reason to order Spotify
AB to re-grant access in accordance with Article 15.
As regards complaint 2, there has been no information that the complainant has been
given access to more personal data or more information following the response to the
request of access in October 2018. Spotify AB should therefore, pursuant to Article
58(2)(c) of the GDPR, be ordered to comply with the complainant’s request of access
under Article 15 of the GDPR by giving the complainant access to all personal data
Privacy Protection Authority Registration number: DI-2019-6696 30(30)
Date: 2023-06-12
that Spotify AB processes about him by providing him with a copy of the personal data
pursuant to Article 15(3) of the GDPR and information pursuant to Article 15(1)(a) to
(h) and (2) of the GDPR. In doing so, Spotify AB has to take into account the
exceptions to the right of access in Article 15(4) of the GDPR and Chapter 5 of the
Swedish Data Protection Act that may be applicable. Access should be provided within
one month of the date of the entry into force of this Decision.
____________________________________
This decision was taken by following a
presentation by the legal advisors and .
and , also participated in the
final proceedings.
Annex
Annex 1 — Complainant’s identification data (complaint 2)
Annex 2 — Spotify AB’s information pursuant to Article 15 GDPR, from 16 November
to 16 May 2022.
Annex 3 — Information about payment of administrative fine