Spotify – €4,900,000 Fine (Sweden, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Sweden fined Spotify EUR 4.9 million for not giving users enough information about their data. Spotify didn't clearly explain where users' data came from or how it was shared internationally. This case shows that companies must be transparent about data handling.
What happened
Spotify failed to provide users with clear information about the origin and international transfer of their data.
Who was affected
Spotify users who were not given sufficient details about their data's origin and international transfers.
What the authority found
The Swedish Data Protection Authority found Spotify did not comply with user rights to information under GDPR.
Why this matters
This case highlights the importance of transparency in data handling. Companies must ensure users understand how their data is used, especially regarding international transfers.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The Swedish Data Protection Authority (DPA) has imposed a fine of EUR 4.9 million on the music streaming provider Spotify. The DPA had launched an investigation after receiving a number of complaints and following a lawsuit filed against Spotify by the Austrian organization 'None of your Business'. In its investigation, the DPA found that Spotify had not sufficiently complied with data subject rights. Spotify failed, for example, to provide data subjects with sufficient information about the origin of their data or international transfers involving their data. Spotify also failed to provide information that was difficult to understand, such as information about technical processes, in the data subjects' native language; rather, such information was only available in English. Spotify has already taken measures to comply with the requirements for the handling of data subject requests. In addition, the DPA classified the identified deficiencies as not very serious.
Related Enforcement Actions (1)
Other enforcement actions involving Spotify in SE
Details
Fine Date
12 June 2023
Authority
Integritetsskyddsmyndigheten
Fine Amount
€4,900,000
Enforcement Tracker ID
ETid-1876
About this data
Cite as: Cookie Fines. Spotify - Sweden (2023). Retrieved from cookiefines.eu
Last updated: