Spotify: a Euro 5 million fine for GDPR Infringement

With decision of June 12 2023, the Swedish Data Protection Authority concluded the proceeding started more than 4 years ago against Spotify, imposing a fine of € 5 million for infringing the right to access users’ personal data.

The complain of Noyb and the action against the Swedish DPA (IMY)

Noyb is a no-profit organization led by the activist Max Schrems, dealing with privacy protection and digital rights at European level.

In January 2019 Noyb had filed a complaint with the Austrian DPA against Spotify, arguing that the streaming music platform did not allow the users to easily access to their own personal data. Since Spotify is located in Sweden, the case was sent to the Swedish Data Protection Authority (IMY).

In June 2022, IMY had not decided on the complaint yet and, after Noyb reminders, it merely replied that the latter was not a party to the procedure. At that point, Noyb reported the inactivity of the Autority to the Swedish court and the case is still pending before the Swedish Supreme Administrative Court.

The decision of IMY

While the proceeding against IMY is still ongoing, the one against Spotify is finally concluded.

In fact, on June 12 2023 the Swedish DPA acknowledged that Spotify infringed the right to access to users’ personal data, guaranteed by article 15 of the GDPR. In particular, it was clarified that the right to access is not limited to the right to obtain a copy of the processed personal data, but it also includes the right of users to obtain all the information relating to how data is acquired, to the parties to whom data are disclosed and to details regarding international transfers.

In the Spotify case, however, the platform granted access only to some personal data, omitting other information. For this reason, it received a € 5 million fine.

Noyb, through its lawyer, said to be satisfied about the decision of the IMY, but it also added that “the case took more than 4 years and we had to litigate the IMY to get a decision. The Swedish authority definitely has to speed up its procedures.”.


Ilaria Feriti