18 November 2024
J.No. 2023-7329-0002
Doc.no. 644221
Caseworker
Final Decision – IMI A56 69121 / CR 112492 The Danish Data
Protection Agency
Regarding your complaint about Spotify AB Carl Jacobsens Vej 35
2500 Valby
The Danish Data Protection Agency (hereinafter the Danish DPA) hereby returns to the case Denmark
T 3319 3200
where, on 8th of June 2019, you made a complaint about Spotify AB (hereinafter Spotify) to the
[email protected]
Danish DPA. datatilsynet.dk
VAT No. 11883729
The Danish DPA considered that the specific case involved cross-border processing of per-
sonal data. As part of the cooperation mechanism for cross-border cases, the Danish DPA
introduced the case to the other EU supervisory authorities. The supervisory authority in Swe-
den, Integritetsskyddsmyndigheten, has dealt with the case as lead (competent) supervisory
authority, in cooperation with the other supervisory authorities. This is due to the fact, that
Spotify’s main establishment is located in Sweden.
Overall, it appears from your complaint that Spotify has been hacked and, in this connection,
usernames and passwords of Spotify's paying customers have been leaked.
The Swedish supervisory authority (hereinafter the Swedish SA) does not take any fur-
ther action based on your complaint
The Swedish SA has now decided to discontinue its investigation and the case is therefore
closed with this letter. The Swedish SA has hereby decided to reject your complaint pursuant
to Article 60(8) of the General Data Protection Regulation (hereinafter GDPR).
The reasons for the Swedish SA’s decision
According to Article 57(1)(f) of the GDPR, supervisory authorities shall handle complaints
lodged by a data subject and investigate, to the extent appropriate, the subject matter of the
complaint.
It is apparent from Article 77 of the GDPR that the data subject or his or her representative
has the right to lodge a complaint against the processing of data concerning him or her. Ac-
cording to Article 4(1) of the GDPR, personal data is any information relating to an identified
or identifiable natural person (‘data subject’).
The Swedish SA has examined your complaint and has assessed that you cannot be consid-
ered a data subject in accordance with Article 77 of the GDPR, and therefore the complaint
does not imply an obligation for the Swedish SA to investigate the alleged incident. This is
because, according to the Swedish SA, it does not appear from your complaint that your per- Page 2 of 2
sonal data has been processed in connection with the hacker attack.
In addition to the obligation to investigate complaints in accordance with Article 77 of the
GDPR, the Swedish SA states that, in the context of complaints, it also has the possibility to
initiate self-initiated audits. The Swedish SA’s decision whether to initiate an audit is taken on
the basis of a risk-based approach in accordance with the supervisory authority's inspection
policy. However, following the assessment by the Swedish SA of the circumstances set out in
your complaint in conjunction with the supervisory policy of the supervisory authority, the Swe-
dish SA has decided not to initiate self-initiated audit. In this assessment, among other things,
the age of the complaint has been taken into account. However, for information purposes, the
Swedish SA informs that it has received another complaint concerning a similar incident at
Spotify, where the supervisory authority has decided to carry out an audit.
Closing remarks
The Danish DPA considers this case closed, and will therefore take no further action in relation
to your complaint.
Decisions of the Danish DPA may not be appealed to any other administrative authority, cf.
Section 30 of the Data Protection Act. However, decisions of the Danish DPA may be chal-
lenged before the courts, cf. Section 63 of the Constitution.
Kind regards