Spotify Violates GDPR Rules, Fined IDR 80.4 Billion Due To Access To User Data

Spotify releases personal data processed by the company (photo: dock. spotify)

JAKARTA - The Swedish Authority for Privacy Protection (IMY) fined Spotify under the General Data Protection Regulation (GDPR), claimed the platform had violated user data access rights in the European Union.

IMY has found a way Spotify handles users' rights to access their personal data.

IMY's assessment said Spotify released personal data that the company processed when users asked for it, but they did not clearly inform how this data was used by the platform.

"The information the company provides about how and for what purpose users' personal data is handled should be more specific. It should be easy for people who ask for access to their data to understand how companies use this data," said one of the legal advisors leading IMY's oversight, Karin Extr\"om in a statement, quoted Wednesday, June 14.

"In addition, elusive personal data, as technical in nature, may need to be explained not only in English but also in the user's original language itself," he added.

According to Extr\"om, users who have switched to Spotify to ask for access to their personal data can choose which personal data they want access to, as the music streaming app has shared subscriber's personal data into different layers.

One layer contains information that Spotify says is the most attractive to these users, such as customer contacts and payment details, which artists customers follow and have a history of listening for a certain period of time.

"If customers want more detailed information, for example all technical log files related to customers, it is also possible to request them on another layer," said Extr\"om.

Extr\"om explained, the purpose of the access rights is to provide users with the opportunity to check their personal data processing legally.

Users who receive information are often prerequisites for carrying out other rights, such as the right to correct or remove misinformation.

Since the information provided by Spotify is unclear, it is difficult for users to understand how their personal data is processed and to check whether their personal data handling is legal.

"It is important for users to understand what information is in various layers and how that information can be requested. Here we believe Spotify is sufficient," said Extr\"om.

Spotify, said Extr\"om has taken some action with the aim of meeting user rights requirements to access, and the deficiencies found are considered overall to have a low level of seriousness.

"In this regard, IMY issued an administrative fine of 5.4 million US dollars (Rp80.4 billion) against Spotify for not providing clear enough information to users," said Extr\"om.