€5 million fine against Spotify for GDPR violations

Swedish Authority for Privacy Protection (IMY) issued an administrative fine against Spotify for shortcomings regarding transparency.

The General Data Protection Regulation, GDPR, entered into force in 2018 and means, among other things, that the rights of individuals are strengthened. One such right is the right of access, which means a right for individuals to find out what personal data a business handles about the person in question and to receive information about how this data is used.

Due to complaints that the Swedish Authority for Privacy Protection (IMY) received against Spotify AB regarding the right of access, IMY has audited how Spotify handles the right for individuals to access their personal data.

IMY finds that Spotify provides to individuals the personal data the company processes when individuals request it. However, Spotify shall also provide information to the person requesting access about how Spotify uses this data and this information must be easy to understand. In addition, personal data that is difficult to understand, such as those of a technical nature, may need to be explained not only in English but in the individual's own, native language. In these parts, IMY has seen certain shortcomings in the audit of Spotify.

The deficiencies that have been discovered are considered overall to be of a low level of seriousness. In light of that and, among other things, the number of registered users and Spotify's turnover, IMY issued an administrative fine of almost EUR 5 million (SEK 58 million) against Spotify for not having provided sufficiently clear information to individuals.

IMY has found shortcomings related to the information pursuant to article 15.1 a-h and 15.2 of the GDPR that should be provided to the individual making the request and to the description of the data in the technical logfiles provided by Spotify. IMY has issued an administrative fine of SEK 58 million against Spotify for not providing sufficiently clear information to individuals in this regard. The decision in this part includes violations of articles 12.1, 15.1 a-d, g and 15.2 of the GDPR.

IMY has further found that Spotify had failed in its handling of requests for access related to two out of three of the complaints examined. The decision in this part includes violation of articles 12.1, 12.3, 15.3 and 15.1 a-h and 15.2 of the GDPR. In relation to these infringements IMY issued a reprimand and an order to comply with one complainant`s request of access. (source: edpb.europa.eu/ photo: freepik.com)

Follow Legalpost.eu on Facebook here

 

Comments

Post a Comment

Editorial

Editorial
George Kazoleas, Lawyer

Top Stories

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

Daily Mail publisher wins case against ‘success fees’ paid to lawyers (ECtHR)

Image
Obligation on publisher of the Daily Mail to pay substantial “success fees" in defamation and breach of privacy cases was excessive. The case Associated Newspapers Limited v. the United Kingdom (application no. 37398/21) concerned the fact that Associated Newspapers Limited the publisher of the Daily Mail and the Mail on Sunday had been obliged to pay extensive costs incurred by claimants who had successfully sued it in privacy and/or defamation proceedings following articles it had published in print or online in 2017 and 2019.  Since one of the claimants had entered into a conditional fee arrangement (CFA) with his legal representative, and both had taken out “after-the-event” (ATE) insurance, Associated Newspapers Limited had been liable not only for their base costs, but also for fee uplifts including the “success fee” in the CFA and for their ATE insurance premiums.  In Chamber judgment (12.11.2024) in the case, the European Court of Human Rights held, unanimously, that t...
Read more

The banks Crédit agricole and Credit Suisse participated in a cartel in the sector for suprasovereign bonds, sovereign bonds and public agency bonds denominated in US dollars

Image
According to the Judgment of the General Court in Cases T-386/21 (Crédit agricole and Crédit agricole Corporate and Investment Bank v Commission) and T-406/21 (UBS Group and Credit Suisse Securities (Europe) v Commission), the banks Crédit agricole and Credit Suisse participated in a cartel in the sector for suprasovereign bonds, sovereign bonds and public agency bonds denominated in US dollars (‘SSA Bonds’).  The General Court of the European Union confirms the Commission’s finding of an infringement and maintains the amount of the fines imposed in 2021. In 2018, the European Commission initiated proceedings for infringement of the competition rules involving Deutsche Bank, Bank of America, Crédit agricole and Credit Suisse (now UBS Group [1] ).  In 2021, the Commission found that those banks had entered into an agreement on the secondary market for suprasovereign, sovereign and agency bonds denominated in dollars (SSA bonds). According to the Commission, traders employed by ...
Read more

A notary does not breach the sanctions against Russia when he or she authenticates the sale of a property owned by an unlisted Russian company (ECJ)

Image
In tis Judgment in Case C-109/23 (Jemerak) [1] the Court of Justice ruled that a notary does not breach the sanctions against Russia when he or she authenticates the sale of a property owned by an unlisted Russian company.  By authentication, a notary does not provide legal advisory services, but acts independently and impartially in the context of a function entrusted to him or her by the State.  A notary in Berlin (Germany) refused to authenticate a contract for the sale of an apartment situated in Berlin and owned by a Russian company. According to that notary, it cannot be ruled out that that authentication infringes the prohibition on the provision of legal advisory services to legal persons established in Russia. The European Union introduced that general prohibition [2] in 2022 with a view to increase pressure on Russia to end its war of aggression against Ukraine [3] . The Berlin Regional Court referred questions to the Court of Justice on this matter. The Court replie...
Read more

ECtHR elects a new Vice-President of the Court and two new Section Presidents

Image
The European Court of Human Rights has elected on 23.9.2024 a new Vice-President of the Court – Judge Ivana Jelić (elected in respect of Montenegro). She will take up her duties on 1 November 2024.  The Court has also elected at the same date two new Section Presidents – Judges Lado Chanturia (elected in respect of Georgia) and Ioannis Ktistakis (elected in respect of Greece). They will also take up their duties on 1 November 2024. Ivana Jelić was born on 17 March 1975 in Podgorica, Montenegro and was elected Judge of the European Court of Human Rights on 12 July 2018. Lado Chanturia was born on 14 April 1963 in Tsalenjikha, Georgia, was elected Judge of the European Court of Human Rights on 8 January 2018 and is Vice-President of Section since 18 May 2023. Ioannis Ktistakis was born on 3 January 1971 in Thebes, Greece and was elected Judge of the European Court of Human Rights on 8 March 2021. (source/photo: echr.coe.int) Read more here
Read more

A national court is not required to apply a decision of its constitutional court that infringes EU law (ECJ)

Image
In its Judgment of 26.9.2024 in Case C-792/22 (Energotehnica) the Court of Justice ruled as regards the right to an effective remedy that a national court is not required to apply a decision of its constitutional court that infringes EU law. In such a case, the national court may not be penalised.  Following the death of an electrician by electrocution during a maintenance operation, an administrative procedure was initiated against his employer. At the same time, criminal proceedings for negligence and manslaughter were initiated against the supervisor. The victim’s next of kin also became civil parties to the criminal proceedings.  The administrative court hearing the dispute concluded that the present case did not involve an ‘accident at work’. It annulled the administrative penalties imposed on the employer. According to national legislation, as interpreted by the Romanian Constitutional Court, that administrative decision prevents the criminal court from reconsidering whe...
Read more

Ethics committee opinions on commissioners’ intended new jobs should be made public, says Ombudsman

Image
The European Ombudsman has suggested the European Commission make public all future opinions adopted by the independent ethics committee concerning former commissioners’ post-mandate jobs. Former commissioners are required to give the Commission two months’ notice when they intend to pursue a professional activity during the two years following their departure. The Commission then examines whether the intended activity is compatible with the commissioner’s post service obligations. If the activity is related to the former commissioner’s portfolio, the Commission consults with the Independent Ethical Committee before taking a decision. Under the Commission’s current practices, if a commissioner withdraws an approval request following a negative opinion from the ethics committee, the Commission does not publish the committee’s opinion. The Ombudsman noted that publishing these opinions would improve transparency and public scrutiny around the Commission’s ability to ensure...
Read more