1(2)
Notice: This document is an unofficial translation of
the Swedish Authority for Privacy Protection´s
decision. COMPLAINANT
See appendix
DATA CONTROLLER
Spotify AB
Diarienummer:
IMY-2024-621 Final decision under the General Data
IMI case register: Protection Regulation – Spotify AB
66495
Datum:
2024-06-27
Decision of the Swedish Authority for Privacy Protection
The Swedish Authority for Privacy Protection (IMY) notes that Spotify AB (556703-
7485) has now complied with the applicant´s request for access. In the light of the
above, IMY finds no reason to take any further action in this case.
The case is closed.
Presentation of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated supervision against
Spotify AB (Spotify) due to a complaint. The complainant has been submitted to IMY,
as the lead supervisory authority under Article 56 GDPR, by the supervisory authority
of the country (Germany) in which the complainant lodged its complain in accordance
with the Regulation´s provisions on cooperation in cross-border processing.
Since it is a cross-border complaint, IMY has made use of the mechanisms got
cooperation and consistency of the GDPR. All supervisory authorities is concerned.
The complainant essentially states the following: The complainant requested access in
accordance of article 15 GDPR from Spotify on the 4th of September 2021. The
complainant received an email from Spotify asking the complainant to verify the
request for access, by clicking on the verify button in the email. However, the e-mail
did not contain a button to click on.
Spotify essentially states the following. Spotify sent an email to the complainant asking
him to verify his email address to be able to access the personal information. The
complainant contacted Spotify with the information that the verify button in the e-mail
that should be used to verify the e-mail address was not shown correctly (not working).
Spotify The 10th of September Spotify informed the complainant that the matter had
been escalated to Spotifys support team for data protection. Spotify initiated an
Postadress:
investigation to investigate whether the problem was an isolated event or if other users
Box 8114
104 20 Stockholm also was affected. The 17th of September Spotify stated that the event was isolated to
the complainant and that other users was not affected. Spotify believe that the problem
Webbplats:
www.imy.se appeared due to that the complainants e-mail client was configurated on an uniqu way
E-post:
that prevented the verify button to be shown correctly. This was explained to the
[email protected] complainant in an e-mail the same day.
Telefon:
08-657 61 00
Page 1 of 2
Integritetsskyddsmyndigheten Diarienummer: IMY-2024-621 2(2)
Datum: 2024-06-27
According to article 12.3 Spotify informed the complainant, the 28th of September 2021,
that it could take more than 30 days to fulfil his request for access if Spotify needed
additional time to resolve the technical problem with delivering the personal data.
The 5th of October Spotify sent an email to the complainant with a new link to download
his personal information. According to Spotifys intern logs, the complainant managed
to download a copy of his personal data the 8th of October.
The complainant was given the opportunity to comment on Spotifys statement. On the
15th of may 2024 the German Data Protection Authority announced that they received
feedback from the complainant, saying that, for him, the matter is settled and the case
can be closed.
Reasons of the decision
Article 57(1)(f) in the GDPR states that IMY shall handle complaints from data subjects
who consider that their personal data are being processed in a manner that violates
the GDPR. It also follows from that provision that, where appropriate, IMY must
examine the subject matter of the complaint. The CJEU has ruled that the supervisory
authority must investigate such complaints with due care.1
Spotify has stated that the company has given the complainant access to his personal
data. The German Data Protection Authority has informed IMY that the complainant,
said that, for him, the matter is settled and the case can be closed.
Against this background, IMY does not find any further action to be taken in this case.
The case should therefore be closed.
1 Schrems II, C 311/18, EU:C:2020:559, paragraph 109
Page 2 of 2