IMY – Court Ruling (Sweden, 2025)

The DPA’s fine Spotify (the data controller) provided customers (the data subjects) with an online function to download their data directly from the controller’s online platform. This download function was meant to provide data subjects with a response to their access requests. In 2019 three complaints were filed in Austria, the Netherlands, and Denmark. The complainants used the controller’s download function and claimed that they did not receive clear and complete information. The data subject who filed a complaint in Austria was represented by noyb. In response to the complaints, the DPA launched an ex officio investigation on Spotify’s handling of access requests from customers. In 2023, after years of inactivity and an interlocutory ruling from the Stockholm administrative courtThis ruling was purely procedural. It is not to be confused with the ruling of June 2024 from the same court, which reviewed the DPA’s decision and lowered the fine. For more information on the interlocutory ruling and the procedural background of the case, see the comment., the DPA finally issued a decision as the lead supervisory authority. The decision was adopted according to the GDPR’s cooperation procedure and addressed both the complaints and the broader findings of the DPA’s investigation. With regards to the controller’s general practices for handling access requests, the DPA found systematic violations of the right of access. Some of the information in the controller’s responses was incomplete, while other information was complete but unclear, as it was provided in the form of technical log files and without a sufficiently clear explanationThe Court upheld the DPA's reasoning on this point. For more details, please refer to the summary for the DPA's decision.. On these grounds, the DPA held that the controller violated violating Articles 15(1)(a)-(d) and (g), 15(2), and 12(1) GDPR. The DPA issued a 58,000,000 SEK (approximately €5,000,000) fine. With regards to the complaints,