Spotify Fined €5M for Inadequate GDPR Data Access Response
Spotify systematically failed to properly respond to GDPR data access requests over a six-month period, providing incomplete, unclear, or overly technical responses without adequate explanation. The Swedish court upheld a €5 million fine, demonstrating that regulatory authorities will enforce significant penalties for non-compliance with fundamental data subject rights. This case highlights that technical compliance alone is insufficient - organizations must ensure their GDPR responses are accessible and comprehensible to ordinary users. The sustained nature of the violations shows the importance of having robust processes for handling data subject requests rather than ad-hoc responses.
Tactical Insight
Immediate actions
- Audit current data access request processes to identify gaps in response completeness and clarity
- Train customer service and legal teams on GDPR Article 15 requirements and user-friendly response formats
- Implement standardized templates for data access responses that avoid technical jargon
Process improvements
- Establish automated tracking systems for data subject request deadlines and response quality
- Create multi-stage review processes involving both technical and non-technical staff before sending responses
- Develop clear data mapping to ensure all personal data categories are included in access responses
Ongoing compliance
- Conduct regular audits of data subject request handling with sample response reviews
- Monitor regulatory guidance updates and court decisions regarding GDPR interpretation
- Implement feedback mechanisms to improve response quality based on data subject complaints