FiS - 13539-23: Difference between revisions
mNo edit summary |
m (→Facts) |
||
(One intermediate revision by one other user not shown) | |||
Line 61: | Line 61: | ||
|Party_Link_3= | |Party_Link_3= | ||
|Appeal_From_Body=IMY | |Appeal_From_Body=IMY (Sweden) | ||
|Appeal_From_Case_Number_Name=DI-2019-6696 | |Appeal_From_Case_Number_Name=DI-2019-6696 | ||
|Appeal_From_Status= | |Appeal_From_Status= | ||
Line 79: | Line 79: | ||
=== Facts === | === Facts === | ||
On 12 June 2023, the Swedish DPA (“''IMY''”) imposed a fine of €5,167,615 (SEK 58 million) | On 12 June 2023, the Swedish DPA (“''IMY''”) imposed a fine of €5,167,615 (SEK 58 million) on ''Spotify AB'' (the controller) for violating the GDPR. The DPA held that the controller did not provide sufficiently clear information in the access request and violated [[Article 12 GDPR#1|Article 12(1)]], [[Article 15 GDPR#1a|15(1)(a)]] to (d), [[Article 15 GDPR#1g|(1)(g)]] and [[Article 15 GDPR#2|(2) GDPR]]. | ||
The controller appealed the DPA’s decision at the Administrative Court of Stockholm (“''Förvaltningsrätten I Stockholm''”) to annul the DPA’s decision, to impose a reprimand instead of a fine or otherwise reduce the imposed fine. | The controller appealed the DPA’s decision at the Administrative Court of Stockholm (“''Förvaltningsrätten I Stockholm''”) and requested to annul the DPA’s decision, to impose a reprimand instead of a fine or otherwise reduce the imposed fine. | ||
The controller did not agree that with the DPA’s reliance on the guidelines of the EDPB and the Article 29 Working Party for their decision, as these were not legally binding. | The controller did not agree that with the DPA’s reliance on the guidelines of the EDPB and the Article 29 Working Party for their decision, as these were not legally binding. | ||
The controller argued that there was no requirement of how the information on categories of personal data should be presented under [[Article 15 GDPR#1b|Article 15(1)(b) GDPR]] and thus it complied with the provision regardless of the generalised information. Also, the controller argued that there was a link to the privacy policy that had a more detailed description of the different categories. | |||
The controller further argued there was no obligation to provide information on the storage periods in relation to each category of personal data under [[Article 15 GDPR#1d|Article 15(1)(d) GDPR]], to provide precise information on the criteria for determining the storage periods and to provide information on which third countries the personal data was transferred to under [[Article 15 GDPR#2|Article 15(2) GDPR]]. Moreover, there was also no obligation to provide a description of the personal data that contained technical log files, and thus also no obligation to provide this in a specific language other than English. | The controller further argued there was no obligation to provide information on the storage periods in relation to each category of personal data under [[Article 15 GDPR#1d|Article 15(1)(d) GDPR]], to provide precise information on the criteria for determining the storage periods and to provide information on which third countries the personal data was transferred to under [[Article 15 GDPR#2|Article 15(2) GDPR]]. Moreover, the controller argued that there was also no obligation to provide a description of the personal data that contained technical log files, and thus also no obligation to provide this in a specific language other than English. | ||
=== Holding === | === Holding === | ||
Line 96: | Line 96: | ||
<u>Information on the purposes, the categories, the recipients and sources ([[Article 15 GDPR#1a|Articles 15(1)(a)]], [[Article 15 GDPR#1b|(b)]], [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g) GDPR]])</u> | <u>Information on the purposes, the categories, the recipients and sources ([[Article 15 GDPR#1a|Articles 15(1)(a)]], [[Article 15 GDPR#1b|(b)]], [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g) GDPR]])</u> | ||
The court | The court first assessed whether the controller provided information on the categories of personal data under [[Article 15 GDPR#1b|Article 15(1)(b) GDPR]]. The court found that the descriptions given by the controller were general and the data included in the categories were not specified. In some categories, no description was given. Therefore, the court held that it was difficult to determine which personal data were included in the various categories and that, therefore, the information provided was not sufficient to assess whether the data subject’s personal data was accurate and was being processed lawfully. | ||
Regarding the link to the privacy policy which contained additional descriptions of the categories, the court held that this required active steps from the data subject as the data subject had to search for the relevant information in the policy on their own. However, the court held that the decisive factor should be whether the information was actually available to the data subject and therefore considered linking the privacy policy as making the information available as required by [[Article 15 GDPR]]. | |||
Therefore, taking into account the information provided on the categories of personal data in the document and the additional descriptions contained in the privacy policy, the court found that the controller provided sufficient information for a data subject to be able to assess whether their personal data was processed and if this was done in a lawful manner. The court therefore found that the controller did not violate [[Article 15 GDPR#1b|Article 15(1)(b) GDPR]]. | |||
Therefore, taking into account the information provided on the categories of personal data in the document and the additional descriptions contained in the privacy policy, the court found that the controller provided sufficient information for a data subject to be able to assess whether their personal data was processed and if this was done in a lawful manner. The court therefore found that the controller did not violate [[Article 15 GDPR#1b|Article 15(1)(b) GDPR]] | |||
The court then looked into whether the controller provided information on the purposes of the processing ([[Article 15 GDPR#1a|Article 15(1)(a) GDPR]]), the recipients or categories of recipient to whom the personal data have been or will be disclosed ([[Article 15 GDPR#1c|Article 15(1)(c) GDPR]]) and any available information of the source when the personal data is not collected from the data subject ([[Article 15 GDPR#1g|Article 15(1)(g) GDPR]]). As the DPA found that the controller violated these Articles because it linked to the various categories of data, the court found that there were no violations of [[Article 15 GDPR#1a|Articles 15(1)(a)]], [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g) GDPR]] either. | The court then looked into whether the controller provided information on the purposes of the processing ([[Article 15 GDPR#1a|Article 15(1)(a) GDPR]]), the recipients or categories of recipient to whom the personal data have been or will be disclosed ([[Article 15 GDPR#1c|Article 15(1)(c) GDPR]]) and any available information of the source when the personal data is not collected from the data subject ([[Article 15 GDPR#1g|Article 15(1)(g) GDPR]]). As the DPA found that the controller violated these Articles because it linked to the various categories of data, the court found that there were no violations of [[Article 15 GDPR#1a|Articles 15(1)(a)]], [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g) GDPR]] either. | ||
However, the court did take into account that the information provided under [[Article 15 GDPR#1a|Articles 15(1)(a)]], [[Article 15 GDPR#1b|(b)]], [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g) GDPR]] were not provided to the data subject in one document, but in different documents. The court found that although the controller linked to their privacy policy in the access request, it was not clear what further information | However, the court did take into account that the information provided under [[Article 15 GDPR#1a|Articles 15(1)(a)]], [[Article 15 GDPR#1b|(b)]], [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g) GDPR]] were not provided to the data subject in one document, but in different documents. The court found that although the controller linked to their privacy policy in the access request, it was not clear what further information the data subject should look up in there. The data subject had to actively look for relevant information. Therefore, the court held that the information provided under [[Article 15 GDPR#1a|Articles 15(1)(a)]], [[Article 15 GDPR#1b|(b)]], [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g) GDPR]] were not sufficiently clear and easily accessible. Thus, the court held that the controller violated [[Article 12 GDPR#1|Article 12(1) GDPR]], agreeing with the DPA. | ||
<u>Information on the storage period and transfer of personal data to third countries (Article 15(1)(d) and (2) GDPR)</u> | <u>Information on the storage period and transfer of personal data to third countries (Article 15(1)(d) and (2) GDPR)</u> | ||
Line 114: | Line 112: | ||
The court agreed with the DPA’s assessment that a prerequisite for a data subject to be able to verify the lawfulness of the processing of his personal data is that it contains an indication of whether a transfer to a third country or an international organisation had actually taken place. The controller failed to provide such information and thus violated [[Article 15 GDPR#2|Article 15(2) GDPR]]. | The court agreed with the DPA’s assessment that a prerequisite for a data subject to be able to verify the lawfulness of the processing of his personal data is that it contains an indication of whether a transfer to a third country or an international organisation had actually taken place. The controller failed to provide such information and thus violated [[Article 15 GDPR#2|Article 15(2) GDPR]]. | ||
The court further noted that a violation of [[Article 15 GDPR]] does not automatically mean a violation of [[Article 12 GDPR#1|Article 12(1) GDPR]]. As the required information under [[Article 15 GDPR#1d|Articles 15(1)(d)]] and [[Article 15 GDPR#2|(2) GDPR]] was missing, the court did not agree with the DPA that the information violated the requirements of [[Article 12 GDPR#1|Article 12(1) GDPR]]. | The court further noted that a violation of [[Article 15 GDPR]] does not automatically mean a violation of [[Article 12 GDPR#1|Article 12(1) GDPR]]. As the required information under [[Article 15 GDPR#1d|Articles 15(1)(d)]] and [[Article 15 GDPR#2|(2) GDPR]] was effectively missing, the court did not agree with the DPA that the information violated the requirements of [[Article 12 GDPR#1|Article 12(1) GDPR]]. | ||
<u>Provision of personal data in the form of technical log files</u> | <u>Provision of personal data in the form of technical log files</u> | ||
The court took into account the CJEU’s judgement of [[CJEU - C-487/21 - F.F. v DSB|case C-487/21]], stating it is for the controller to take measures to ensure that the personal data provided to the data subject are intelligible. The court held that the controller is obligated to take appropriate measures to render the data intelligible, for example, by providing a description of them, to comply with [[Article 12 GDPR#1|Article 12(1) GDPR]]. In this case, the personal data in question were in the form of technical log files consisting of codes and numbers, which are by their nature difficult to understand. Although the controller provided a more detailed description of the technical log files in English, the court found that this could not be considered to be making the log files comprehensible to everyone. The court found that especially a data subject who had requested a copy of their personal data containing technical log files should not have to take their own initiative make the information comprehensible. Therefore, the court found that the measures taken by the controller were not sufficient to ensure that the personal data in the technical log files were intelligible and thus violated [[Article 12 GDPR#1|Article 12(1) GDPR]]. | The court took into account the CJEU’s judgement of [[CJEU - C-487/21 - F.F. v DSB|case C-487/21]], stating it is for the controller to take measures to ensure that the personal data provided to the data subject are intelligible. The court held that the controller is obligated to take appropriate measures to render the data intelligible, for example, by providing a description of them, to comply with [[Article 12 GDPR#1|Article 12(1) GDPR]]. In this case, the personal data in question were in the form of technical log files consisting of codes and numbers, which are by their nature difficult to understand. Although the controller provided a more detailed description of the technical log files in English, the court found that this could not be considered to be making the log files comprehensible to everyone. The court found that especially a data subject who had requested a copy of their personal data containing technical log files should not have to take their own initiative to make the information comprehensible. Therefore, the court found that the measures taken by the controller were not sufficient to ensure that the personal data in the technical log files were intelligible and thus violated [[Article 12 GDPR#1|Article 12(1) GDPR]]. | ||
<u>Conclusion</u> | <u>Conclusion</u> | ||
The court thus found that the controller did not violate [[Article 15 GDPR#1a|Articles 15(1)(a)]] to [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g)]] GDPR. However, the information in these parts were provided in such a way that it did violate [[Article 12 GDPR#1|Article 12(1) GDPR]]. Moreover, the court found that the controller violated [[Article 15 GDPR#1d|Articles 15(1)(d)]] and [[Article 15 GDPR#2|15(2) GDPR]], but did not | The court thus found that the controller did not violate [[Article 15 GDPR#1a|Articles 15(1)(a)]] to [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g)]] GDPR. However, the information in these parts were provided in such a way that it did violate [[Article 12 GDPR#1|Article 12(1) GDPR]]. Moreover, the court found that the controller violated [[Article 15 GDPR#1d|Articles 15(1)(d)]] and [[Article 15 GDPR#2|15(2) GDPR]], but did not found the information in these parts to also violate [[Article 12 GDPR#1|Article 12(1) GDPR]]. Lastly, the court found that the controller did violate [[Article 12 GDPR#1|Article 12(1) GDPR]] as the measures taken have not been sufficient to ensure that the personal data in the technical log files have been intelligible. | ||
As the court did not find violations of [[Article 15 GDPR#1a|Articles 15(1)(a)]], [[Article 15 GDPR#1b|(b)]], [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g) GDPR]] and [[Article 12 GDPR#1|Article 12(1) GDPR]] in the information provided on the storage period and transfer of personal data to third countries, the court reduced the fine to €3,484,720 (SEK 40 million). The Administrative Court thus partially upheld the appeal. | As the court - contrary to the DPA - did not find violations of [[Article 15 GDPR#1a|Articles 15(1)(a)]], [[Article 15 GDPR#1b|(b)]], [[Article 15 GDPR#1c|(c)]] and [[Article 15 GDPR#1g|(g) GDPR]] and [[Article 12 GDPR#1|Article 12(1) GDPR]] in the information provided on the storage period and transfer of personal data to third countries, the court reduced the fine to €3,484,720 (SEK 40 million). The Administrative Court thus partially upheld the appeal. | ||
== Comment == | == Comment == |
Revision as of 14:11, 16 July 2024
FiS - 13539-23 | |
---|---|
Court: | FiS (Sweden) |
Jurisdiction: | Sweden |
Relevant Law: | Article 12(1) GDPR Article 15(1)(a) GDPR Article 15(1)(b) GDPR Article 15(1)(d) GDPR Article 15(1)(g) GDPR Article 15(1)(c) GDPR Article 15(2) GDPR |
Decided: | 28.06.2024 |
Published: | |
Parties: | Spotify AB |
National Case Number/Name: | 13539-23 |
European Case Law Identifier: | |
Appeal from: | IMY (Sweden) DI-2019-6696 |
Appeal to: | |
Original Language(s): | Swedish |
Original Source: | GDPRhub (in Swedish) |
Initial Contributor: | ec |
The Administrative Court of Stockholm reduced the DPA's fine to €3,484,720 (SEK 40 million) against Spotify, because not providing information under Article 15 GDPR does not automatically mean a violation of Article 12(1) GDPR.
English Summary
Facts
On 12 June 2023, the Swedish DPA (“IMY”) imposed a fine of €5,167,615 (SEK 58 million) on Spotify AB (the controller) for violating the GDPR. The DPA held that the controller did not provide sufficiently clear information in the access request and violated Article 12(1), 15(1)(a) to (d), (1)(g) and (2) GDPR.
The controller appealed the DPA’s decision at the Administrative Court of Stockholm (“Förvaltningsrätten I Stockholm”) and requested to annul the DPA’s decision, to impose a reprimand instead of a fine or otherwise reduce the imposed fine.
The controller did not agree that with the DPA’s reliance on the guidelines of the EDPB and the Article 29 Working Party for their decision, as these were not legally binding.
The controller argued that there was no requirement of how the information on categories of personal data should be presented under Article 15(1)(b) GDPR and thus it complied with the provision regardless of the generalised information. Also, the controller argued that there was a link to the privacy policy that had a more detailed description of the different categories.
The controller further argued there was no obligation to provide information on the storage periods in relation to each category of personal data under Article 15(1)(d) GDPR, to provide precise information on the criteria for determining the storage periods and to provide information on which third countries the personal data was transferred to under Article 15(2) GDPR. Moreover, the controller argued that there was also no obligation to provide a description of the personal data that contained technical log files, and thus also no obligation to provide this in a specific language other than English.
Holding
EDPB’s Guidelines
The court agreed with the controller that the EDPB and Article 29 Working Party Guidelines are not legally binding. However, the court held that they can be used to support the interpretation of the GDPR. The court further held that the DPA had not based its decision on the requirements in the EDPB’s guidelines or other requirements that do not follow from the GDPR.
Information on the purposes, the categories, the recipients and sources (Articles 15(1)(a), (b), (c) and (g) GDPR)
The court first assessed whether the controller provided information on the categories of personal data under Article 15(1)(b) GDPR. The court found that the descriptions given by the controller were general and the data included in the categories were not specified. In some categories, no description was given. Therefore, the court held that it was difficult to determine which personal data were included in the various categories and that, therefore, the information provided was not sufficient to assess whether the data subject’s personal data was accurate and was being processed lawfully.
Regarding the link to the privacy policy which contained additional descriptions of the categories, the court held that this required active steps from the data subject as the data subject had to search for the relevant information in the policy on their own. However, the court held that the decisive factor should be whether the information was actually available to the data subject and therefore considered linking the privacy policy as making the information available as required by Article 15 GDPR.
Therefore, taking into account the information provided on the categories of personal data in the document and the additional descriptions contained in the privacy policy, the court found that the controller provided sufficient information for a data subject to be able to assess whether their personal data was processed and if this was done in a lawful manner. The court therefore found that the controller did not violate Article 15(1)(b) GDPR.
The court then looked into whether the controller provided information on the purposes of the processing (Article 15(1)(a) GDPR), the recipients or categories of recipient to whom the personal data have been or will be disclosed (Article 15(1)(c) GDPR) and any available information of the source when the personal data is not collected from the data subject (Article 15(1)(g) GDPR). As the DPA found that the controller violated these Articles because it linked to the various categories of data, the court found that there were no violations of Articles 15(1)(a), (c) and (g) GDPR either.
However, the court did take into account that the information provided under Articles 15(1)(a), (b), (c) and (g) GDPR were not provided to the data subject in one document, but in different documents. The court found that although the controller linked to their privacy policy in the access request, it was not clear what further information the data subject should look up in there. The data subject had to actively look for relevant information. Therefore, the court held that the information provided under Articles 15(1)(a), (b), (c) and (g) GDPR were not sufficiently clear and easily accessible. Thus, the court held that the controller violated Article 12(1) GDPR, agreeing with the DPA.
Information on the storage period and transfer of personal data to third countries (Article 15(1)(d) and (2) GDPR)
The court found that the information provided on the storage period and the criteria used to determine that period was of a general nature and lacked detailed descriptions. Therefore, the court held that the controller did not provide sufficient information to the data subject for them to assess whether their personal data was accurate and processed lawfully. Thus, the court held that the controller did violate Article 15(1)(d) GDPR.
The court agreed with the DPA’s assessment that a prerequisite for a data subject to be able to verify the lawfulness of the processing of his personal data is that it contains an indication of whether a transfer to a third country or an international organisation had actually taken place. The controller failed to provide such information and thus violated Article 15(2) GDPR.
The court further noted that a violation of Article 15 GDPR does not automatically mean a violation of Article 12(1) GDPR. As the required information under Articles 15(1)(d) and (2) GDPR was effectively missing, the court did not agree with the DPA that the information violated the requirements of Article 12(1) GDPR.
Provision of personal data in the form of technical log files
The court took into account the CJEU’s judgement of case C-487/21, stating it is for the controller to take measures to ensure that the personal data provided to the data subject are intelligible. The court held that the controller is obligated to take appropriate measures to render the data intelligible, for example, by providing a description of them, to comply with Article 12(1) GDPR. In this case, the personal data in question were in the form of technical log files consisting of codes and numbers, which are by their nature difficult to understand. Although the controller provided a more detailed description of the technical log files in English, the court found that this could not be considered to be making the log files comprehensible to everyone. The court found that especially a data subject who had requested a copy of their personal data containing technical log files should not have to take their own initiative to make the information comprehensible. Therefore, the court found that the measures taken by the controller were not sufficient to ensure that the personal data in the technical log files were intelligible and thus violated Article 12(1) GDPR.
Conclusion
The court thus found that the controller did not violate Articles 15(1)(a) to (c) and (g) GDPR. However, the information in these parts were provided in such a way that it did violate Article 12(1) GDPR. Moreover, the court found that the controller violated Articles 15(1)(d) and 15(2) GDPR, but did not found the information in these parts to also violate Article 12(1) GDPR. Lastly, the court found that the controller did violate Article 12(1) GDPR as the measures taken have not been sufficient to ensure that the personal data in the technical log files have been intelligible.
As the court - contrary to the DPA - did not find violations of Articles 15(1)(a), (b), (c) and (g) GDPR and Article 12(1) GDPR in the information provided on the storage period and transfer of personal data to third countries, the court reduced the fine to €3,484,720 (SEK 40 million). The Administrative Court thus partially upheld the appeal.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Page 2 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM BACKGROUND The Swedish Privacy Authority (IMY) decided on 12 June 2023 that, among other things, impose a sanction fee of SEK 58 million on Spotify AB (Spotify) for violations of the data protection regulation. As reasons for the decision in this part stated IMY that Spotify during the period 16 November 2021–16 May 2022 in the information to be provided according to article 15.1 and 15.2 i the data protection regulation did not provide sufficiently clear information about the purposes of the processing, categories of personal data to which the processing applies, categories of recipients of the personal data, the anticipated periods during which personal data will stored or, if this is not possible, the criteria used to determine this period, where personal data comes from, as well as appropriate protective measures when personal data is transferred to third countries. Furthermore, IMY stated that Spotify during the period 11 June 2019–16 May 2022 by providing by default the description of the data in them the technical log files in English have not met the requirements that all communications provided to the data subject pursuant to Article 15 i the data protection regulation must be clear and comprehensible in the manner specified in article 12.1 of the data protection regulation. Spotify has thus processed personal data in violation of articles 12.1, 15.1 a-d, 15.1 g and 15.2 of the data protection regulation. 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free flow of such information and on the repeal of Directive 95/46/EC (General Data Protection Regulation). Doc.Id 1750289 Page 3 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM The IMY also decided to impose a reprimand on Spotify for not handling two was registered the request to access personal data in accordance with data protection regulation. As the reason for the decision in this part, IMY stated, regarding complaint 1, that Spotify in its handling of the complainant's request for access made on 27 May 2018 has processed personal data in violation of article 12.3 of the data protection regulation, by placing the copy on personal data has been submitted too late, and articles 12.1, 15.1 and 15.3 of the data protection regulation, by the copy of personal data that Spotify did not have provided all the complainant's personal data in an understandable way form. Regarding complaint 2, IMY stated that Spotify in its handling of the complainant the access request made on October 10, 2018 has been processed personal data in violation of articles 15.1 and 15.3 of the data protection regulation, by that in it copy of personal data that Spotify has not given access to to all personal data that Spotify processed about it complainant, and articles 15.1 a-h and 15.2 of the data protection regulation, by have not provided any of the information listed therein regulations. Regarding complaint 2, IMY also decided to order Spotify to, at the latest, a month after the decision became final, accommodate the appellant's request for access. The reasons for the decision in their entirety appear in Appendix 1. Doc.Id 1750289 Page 4 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM CLAIMS, M.M. Spotify primarily requests that the administrative court cancel the appeal the decision in its entirety. Alternatively, it is requested that the company instead of a penalty charge is imposed a reprimand and thirdly that imposed penalty charge is put down. IMY considers that the appeal should be rejected. On June 5, 2024, the Administrative Court held an oral hearing in the case. THE REASONS FOR THE DECISION Starting points for the trial The questions in the case The first question that the administrative court has to examine is whether Spotify should a penalty fee is imposed on the grounds put forward by IMY. More specifically is the question of the information that Spotify has provided to registrants under the period 16 November 2021–16 May 2022 has fulfilled the requirements in articles 12.1 and 15 of the data protection regulation and on the provision of technical log files during the period 11 June 2019–16 May 2022 have met the requirements in article 12.1 of the data protection regulation. The administrative court also has to take a position on Spotify when dealing with two data subjects' requests for access to their personal data have been violated articles 12 and 15 of the data protection regulation. If so have the administrative right to examine whether the company should be reprimanded. Doc.Id 1750289 Page 5 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM Burden of proof and proof requirements According to the principle of accountability, the personal data controller must be able to show that the processing of personal data is carried out in accordance with the provisions of the data protection regulation (articles 5.2 and 24 i data protection regulation). This means that it is the personal data controller who has the burden of proof that the processing meets the requirements of the regulations (The judgment of the European Court of Justice on 24 February 2022 in case C-175/20 "SS" SIA et al., paragraphs 77–81). It must also be clearly stated that there are conditions for imposing a certain administrative penalty fee and it is IMY that has the burden of proof in that respect (see the Court of Appeal in Stockholm's judgment on January 26, 2023 in case no 1552-22). Guidelines Spotify has objected that some of the requirements that IMY lays the basis for the violations are based on an interpretation of guidelines announced by the European data protection board (European Data Protection Board, EDPB) and Article-29 the group. Spotify asserts that these guidelines lack standing as a source of law and is not legally binding. Nor were the EDPB guidelines on the right of access adopted at the time of the alleged violations. The Article 29 Group was established pursuant to Article 29 of the Data Protection Directive 95/46/EC. On 29 November 2017, the group adopted guidelines on transparency according to regulation (EU) 2016/679. Through the introduction of the data protection regulation, the group has replaced by the EDPB. The EDPB has, among other things, tasked with issuing guidelines and recommendations regarding the interpretation of the data protection regulation. The EDPB has adopted the Article 29 Working Party's guidelines on transparency. Doc.Id 1750289 Page 6 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM The Administrative Court notes in this regard that the guidelines cannot determine binding obligations unless the interpretation of the requirements they express because can be deduced from the wording of the regulation text. That this is the case follows generally accepted requirements for legality and predictability. Administrative law further notes that IMY has not asserted that Spotify has violated requirements in EDPB's guidelines, or imposed other requirements that do not follow from data protection regulation as the basis for the decision. However, the purpose of the guidelines is to promote a uniform application of the regulation by the supervisory authorities i Member States of the EU. The guidelines are not legally binding but may according to the sentence of the administrative court be used as support in the interpretation of data protection regulation. Any possibility of imposing sanctions from outside the guidelines and without support in the data protection regulation do not exist, however. Legal starting points In Article 15 of the Data Protection Regulation, the information is specified as a registered has the right to receive from the personal data controller in question personal data concerning him or her. This information shall according to Article 12.1 is submitted in a concise, clear, clear, comprehensible and easily accessible form, using clear and unambiguous language. Article 15 thus specifies what information must be provided, while Article 12.1 imposes requirements on how this information must be provided. An application of Article 12.1 presupposes both that information has actually been provided and that there is one information requirements according to Article 15. Doc.Id 1750289 Page 7 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM Spotify's general procedures for handling requests for access Information to data subjects according to article 15.1 a-c and 15.1 g According to Article 15.1 a-c and 15.1 g, the personal data controller must leave information about the purposes of the processing of personal data, they categories of personal data to which the processing applies, the recipients or categories of recipients to whom the personal data has been or will be provided disclosed, especially recipients in third countries or international organizations and if the personal data is not collected from the data subject, all available information about where this data comes from. During the time period relevant to the case, Spotify has provided information according to Article 15 of the Data Protection Regulation in a special document (Article 15- information). In each copy of personal data provided to the registrant pursuant to Article 15.3, a link to the Article 15 information has been included. IN the article 15 information, there has in turn been a link to Spotify's privacy policy in which supplementary information about the processing of the personal data has existed. Spotify states that the information about categories of personal data that provided corresponds well with the data protection regulation's requirements. Whether it information provided was too general and meaningless because Article 15.1 b of the data protection regulation does not prescribe a requirement to the information must be designed in a certain way. Notwithstanding this provided Spotify descriptions of the different categories in the Article 15 information and in addition, detailed descriptions in the privacy policy. That registrants were provided with a link to the privacy policy in the Article 15 information does not mean that they actively needed to search for information in question. If it left the description in despite this, the privacy policy would be judged to be difficult to access, this is one relationship that aims at how the description has been provided and not Doc.Id 1750289 Page 8 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM the information as such. The company has further provided in Article 15 the information all the information that the company is obliged to provide about the purposes of the processing, the recipients or categories of recipients and that of the personal data source. The company also provided this information in relation to various categories. Users thus had the opportunity to find out how their different personal data was processed. IMY points out that the information provided by Spotify about categories of personal data has been generally held and lacking further explanations. The information has not enabled the data subject to ascertain that the personal data concerning him or her are correct and that they processed in a lawful manner. Furthermore, the registered person must not actively themselves need to search for information that the data controller is obliged to hand over to the data subject. Spotify's statement that there were descriptions of certain categories of personal data in the privacy policy are therefore irrelevant for the assessment of the clarity of the information in this regard. This as this information cannot be considered to have been provided to the data subject. IMY has stated at the oral hearing that in the event that the information in the privacy policy is considered to have been provided to the individual if it, together with the Article 15 information, sufficient to the information requirement according to Article 15.1 b must be fulfilled. The Administrative Court makes the following assessment. In the interpretation of a Union provision, it is not only the wording that is in accordance with its customary meaning in normal language to be considered, but also the context and the goals pursued by the regulations which the provision is included in (the judgment of the European Court of Justice on 4 May 2023 in case no. C-487/21 p. 19 and the case law cited there). Doc.Id 1750289 Page 9 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM Article 15 of the data protection regulation further imposes a more far-reaching requirement on the information that is provided to registered than that it only to his wording must comply with the information obligation in the article. For that the information provided to data subjects shall be considered to meet the requirements which follows from Article 15, it must enable the data subject to insure that the personal data concerning him or her are correct and that they processed in a legal manner (cf. the judgment of the European Court of Justice on 4 May 2023 in the case C‑487/21 p. 34 and recital 63 of the data protection regulation). The question is therefore about the information that Spotify has provided to registered users this part has enabled such control. According to the opinion of the administrative court it is a prerequisite for this that the information provided has gone through to find out which personal data is processed in which ways. The Article 15 information provided to data subjects specifies which categories of personal data that Spotify processes. In connection with some of the categories are also given a description of which tasks are included in each category. However, according to the opinion of the administrative court, these descriptions are generally held and which information the categories include is not specified closer. Regarding the categories of user data and usage data is given no description at all and there is a lack of other clarifications example. The Administrative Court considers that, based on this information, it is difficult to determine which personal data is included in the various categories and that the information provided in this part is therefore not sufficient to a registered person must be able to assess whether the personal data concerning him or her are correct and that they are processed in a legal manner. However, the Article 15 information contains a link to Spotify's privacy policy. The privacy policy contains, among other things, supplementary information descriptions of the categories of personal data that Spotify processes. IMY has submitted that this information should not be considered because it cannot be considered Doc.Id 1750289 Page 10 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM have been given to the registered person when he has had to search for it the information itself. The Article 29 group's guidelines on transparency state, among other things, that the requirement that the personal data controller must provide information to the registered means that the controller must take active steps to provide the information in question to the data subject or actively accompany the data subject to the location where the information is located (e.g. via a direct link). The registered shall not have to actively search for such information covered by these articles among other information, such as terms of use for a website or app. The Administrative Court initially notes that the guidelines deal with the application of Article 12(1) in relation to Articles 13 and 14 i data protection regulation. However, the Administrative Court believes that the guidelines can serve as guidance also in the application of Article 12(1) in relation to Article 15. The administrative court assesses that Spotify by linking to the privacy policy in the Article 15 information may be deemed to have taken active steps to provide the information in question to the data subject. Admittedly, the link has been to the whole the privacy policy and not only to the parts containing Article 15- information. The registered person has therefore had to independently search for relevant information in the document. When assessing whether the company is to be considered to have given the registered access to the information according to Article 15 i the data protection regulation, however, the administrative court considers that the decisive factor is that the information has actually been available to the data subject. By the link to the privacy policy, the administrative court considers that the information has made available to such an extent that it can be taken into account in the assessment of if Spotify has met the requirements of Article 15 of the Data Protection Regulation. Doc.Id 1750289 Page 11 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM In a balanced assessment of the information given about the personal data categories in the Article 15 information along with those supplementary descriptions found in the privacy policy consider the administrative court that Spotify has provided enough information to a registrant must be able to understand which information is included in each category. The information has thus overall made it possible for a registered person to check that the personal data is handled correctly and legally. Against against this background, the administrative court judges that Spotify has not violated the article 15.1 b of the data protection regulation. It appears from the appealed decision that IMY has assessed that the violations of Article 15.1 a, c and g is due to the fact that the information in these parts has been linked to them the various categories of personal data. That the information about purpose, recipient and source as such has been deficient has not been asserted in the case. Because the administrative court considers that it provided the information according to article 15.1 b has been sufficient, there is therefore also no violation of Article 15.1 a, c and g. IMY has also assessed that the information provided pursuant to Article 15.1 a-c and 15.1 g has not been sufficiently concise, clear and clear and neither readily available. According to IMY, it has therefore not met the requirements in Article 12.1 i data protection regulation. It appears from the Article 29 Group's guidelines on transparency that the requirement to information provided or communicated to the data subjects shall be in a "concise, clear and clear" form means that the data controllers should present the information in an efficient and concise manner to avoid information exhaustion. The information should be clearly distinguished from others information that does not relate to privacy, for example contractual provisions or general terms of use. The requirement that the information be easily accessible means that it should be immediately obvious to the registered where and how they can Doc.Id 1750289 Page 12 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM access the information. The Article 29 Group recommends that all the information addressed to the data subjects should also be available on a single place or in a single document. The Administrative Court notes that the information in question has not been collected in one place without it having been given to the registrant in different documents. Spotify has indeed linked to the privacy policy in the Article 15 information but according to the opinion of the administrative court, it has not been clear which additional information that was available there. The data subject thus has had to actively look for relevant information about, for example, those categories of personal data that Spotify processes. The administrative court considers against this background that the information provided pursuant to article 15.1 a-c and 15.1 g of the data protection regulation has not been sufficiently clear and readily available. The administrative court therefore considers, similarly to IMY, that Spotify i this part has violated Article 12.1 of the Data Protection Regulation. Information to data subjects according to Article 15.1 d Article 15.1 d of the data protection regulation states that it personal data controller must provide information about the anticipated period during which the personal data will be stored or, if this is not possible, the criteria used to determine this period. Spotify states that the company has provided information about the criteria that used to determine retention periods. Any obligation to leave information on storage periods in relation to the respective category of however, personal data does not exist. Furthermore, there is also none obligation to provide precise information about the criteria for determining the storage periods. Doc.Id 1750289 Page 13 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM IMY submits that it provided the information on storage periods and criteria for determining these was very imprecisely designed, e.g. through vague concepts such as "legitimate business reasons" and that data is "usually" kept under lifetime of an account. Overall, it has not been possible for data subjects to through the information provided by Spotify understand and control the preservation of his or her personal data was legal. The Administrative Court makes the following assessment. Spotify's Article 15 information shows, among other things, that personal data is kept that way for as long as it takes to provide the Spotify service for the data subject and for legitimate and essential business purposes. Furthermore, examples are given of them criteria used to determine the retention periods. Among these stated that the standard period for retention of personal data is 90 days, unless a longer period is chosen due to a legitimate business reason. Further it is stated that personal data is retained for an appropriate period to deliver a personal service to the data subject and that streaming history usually retained for the lifetime of an account. The administrative court considers that Spotify has provided certain information about it period during which the personal data is stored as well as, in cases where this is not possible, the criteria used to determine this period. The information is however generally designed and there is a lack of detailed descriptions of how long the data subject's various personal data are actually stored. As IMY brings forward vague and imprecise concepts are further used to describe the criteria which used to determine the storage periods. The administrative court considers that Spotify has not provided enough information to make that possible a registered person to ensure that the personal data concerning him or her are correct and that they are processed in a legal manner. Spotify has thus violated Article 15.1 d of the data protection regulation. Doc.Id 1750289 Page 14 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM IMY has also assessed with regard to this information that the requirements to the information must be provided in a concise, clear, and easily accessible form have not been fulfilled. The Administrative Court would like to point out at the outset that a violation of Article 15 does not automatically entail a violation of Article 12.1. The circumstance that information that must be provided according to Article 15 is missing means according to the opinion of the administrative court does not in itself mean that there is also a violation of article 12.1. The Administrative Court has assessed that Spotify violated Article 15.1 d as the company has not provided enough information about its storage of personal data. However, the Administrative Court does not consider that IMY has been prejudicial show that the information that Spotify has actually provided has not been compliant with the requirements in Article 12.1. There is therefore no simultaneous infringement of Article 12.1 of this part. Information to data subjects according to Article 15.2 Article 15.2 of the data protection regulation stipulates that the personal data transferred to a third country or to an international organization, it shall data subjects have the right to information about the appropriate protective measures as i in accordance with Article 46 has been taken at the time of the transfer. Spotify states in this part that the company has provided information about the appropriate ones protective measures taken when transferring data to a third country. It is objected to there being a requirement to indicate to which third countries the personal data has been transferred. In the case of transfers to third countries relied on Spotify to a certain extent on the decision of the European Commission on adequate protection level. When a decision on an adequate level of protection was missing, Spotify applied during the relevant period only standard contract clauses as appropriate protective measure. With this in mind, Spotify admits that the current the information could have been designed without indicating that the appropriate Doc.Id 1750289 Page 15 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM the protective measures "e.g." were made up of standard contract clauses. The concept "for example." was used to avoid making the information incomplete and referred to, in addition to standard contract clauses, the adequacy decisions that some transfers relied on. Spotify also acknowledges that the information that provided if appropriate protective measures were general. However, this was one result of standard contract clauses being the only appropriate safeguard which Spotify actually applied. The general writing was thus under it current period applicable to all users, and there was accordingly no need for any individualization and further description. IMY states that in order for the data subject to be able to check that it treatment concerning him or her is legal must information about appropriate protective measures according to Article 15.2 at least include information which clarifies whether the data subject's personal data has been transferred to a third party country and, if so, to which countries and indicating which safeguards. Spotify has not provided such information. IMY further considers that it lacks meaning that Spotify at the time in question only applied standard contract clauses, as it is not something that the data subject would have been able to do know without being informed of it. The Administrative Court makes the following assessment. The Administrative Court assesses that the wording of Article 15.2 i the data protection regulation states that the obligation to provide information refers to appropriate safeguards taken when data has actually been transferred to one third country or to an international organization. So it's not just a question about an obligation to inform about the appropriate protective measures that generally be taken in this regard. Instead, the information provided according to article 15 be adapted to the data subject's situation. Administrative law shares IMY's assessment that a prerequisite for a registered person to be able to check that the processing of his personal data is legal is that the information Doc.Id 1750289 Page 16 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM contains information on whether a transfer to a third country or a international organization has actually taken place. The information that Spotify provided to registered users has lacked such information. The Administrative Court considers that this constitutes a violation of Article 15.2 of the Data Protection Regulation. IMY has also assessed the information provided in accordance with Article 15.2 that the provision has not been compatible with Article 12.1. So like the administrative court stated above does not mean a lack of information according to Article 15 necessarily a deficiency under Article 12(1). As for the violation of article 15.2, the administrative court has assessed that this is mainly due to the fact that has been missing relevant information and not that the content actually provided to the data subject itself has been difficult to access or unclear. Of the the appealed decision does not specify in what way IMY considers that it the information provided is incompatible with Article 12.1. The administrative court considers nor that IMY has otherwise given a sufficiently clear account of which circumstances that would entail a violation in this case. Against this one background, the administrative court considers that IMY in this part has not shown that Spotify has acted in violation of Article 12.1 of the Data Protection Regulation. The provision of personal data in the form of technical log files In connection with a registered person having received a copy of personal data containing technical log files, Spotify has also provided a description of these. This is to help the user understand the data. Spotify has partly provided a detailed description of the files in English, partly an overview description in the user's local language. At the request of the data subject Spotify also assisted with a translation of the detailed description. IMY has assessed that the detailed description has been necessary in order to enable a user to assimilate the information in the log files. That the description, as a starting point, has only been provided in English means, however, according to IMY, that Spotify has not taken sufficient measures to Doc.Id 1750289 Page 17 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM ensure that users understand the description of the data. The information has thus not met the requirements that all communication according to Article 15 i the data protection regulation must be clear and comprehensible in the manner specified in article 12.1. In this part, Spotify presents, among other things, following. The company has in accordance with article 15.3 of the data protection regulation provided a copy of them upon request data subject's personal data. Any obligation to provide one description of this personal data, or even less to provide one such a description in a certain language, however, does not exist. One reason the technical log files were provided as a starting point English was that they reflect technical concepts and codes that above all communicated in English and where local translations are often established is missing. It is not considered to be justified that in all requests for technical log files provide the detailed description of these on local languages. If a user requests that the files be translated, Spotify assists free of charge with such a translation. Out of about 400,000 requests that Spotify has received since 2018 only three users have requested one translation of the detailed description into their local languages. It shows that it would be disproportionate to as a starting point and without special request provide the description in all users' own languages. IMY adds in this part i.a. following. Exactly which actions a the personal data controller must take steps to make personal data comprehensible to them registered may be assessed based on the circumstances of the individual case. The question the language in which information is to be provided must be assessed against the background of the purpose of the provision. A description provided in a language of the registrant does not master cannot help to make the tasks comprehensible to it registered. IMY has not stated that Spotify should translate its detailed description of the technical log files in their entirety. However, a closer one is required Doc.Id 1750289 Page 18 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM description in local language of the central concepts in the technical log files or other information that makes the personal data comprehensible to it registered. The Administrative Court makes the following assessment. The European Court of Justice has stated that to ensure that the information which provided is easy to understand, as required by Article 12.1 i the data protection regulation, compared with recital 58 of the same regulation, it can show it may be necessary to reproduce extracts from documents or even the whole of them documents or extracts from databases, which, among other things, contain them personal data that is processed, if it is necessary that they processed the information is put into context to ensure that it is understandable (Judgment of the European Court of Justice on 4 May 2023 in case C-487/21 p. 41). The Administrative Court considers that the EU Court's statement can be understood as saying that it is up to the personal data controller to take measures to ensure that the personal data provided to the data subject is comprehensible. IN in the current case, it is a matter of personal data in the form of technical log files consisting of i.a. codes and numbers. Personal data of this kind is for its own nature difficult to understand. According to the administrative court's opinion, it has therefore been imposed Spotify to take appropriate measures to make the data comprehensible, for example by providing a description of these, in order to provide shall be compatible with Article 12.1 of the Data Protection Regulation. The question then is whether the measures that Spotify has taken in this regard have been sufficient for a data subject to be able to understand the content of the log files. In the overview description of the data in the technical log files, which provided in the registrant's local language, it is stated that these contain detailed technical data such as commands, error messages and log strings such as Doc.Id 1750289 Page 19 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM Spotify collected to be able to provide and troubleshoot the service. However, the description lacks further information and administrative law assesses that based on this it has not been possible for a registered person to understand the data in the log files. However, Spotify has also provided a more detailed description of them the technical log files. In the case it is undisputed that this description has done so possible for a registered user to utilize the information in the files. However, the description has only been provided in English as a starting point. Admittedly, there is no express requirement in Article 12(1) or Article 15 i the data protection regulation that information must be provided in a certain way language. However, the Administrative Court shares IMY's assessment that it may be considered to follow the purpose behind the right of access as well as the requirements in Article 12.1 that information to a registered is in a language that he/she knows. Against this background, one can description provided only in English is not considered to contribute to making the log files comprehensible to all users targeted by Spotify. Spotify has in this regard brought forward that users have been given clear information about the possibility of having the description translated into their local languages and that such the request has only been made in a few cases. However, the Administrative Court considers that a data subject who requested a copy of personal data containing technical log files should not have to take their own initiative to obtain information that is understandable. Instead, it arrives on Spotify, as personal data controller, that even without further request from data subjects ensure that the information provided is easy to understand. That users have was able to return to Spotify to have the description translated weighs according to The administrative court's opinion therefore does not fully account for this deficiency. In summary, the Administrative Court has found that the information which registered may in their local language has not been extensive enough to it must be possible to understand the personal data in the technical log files. The detailed description provided in English has also not been rated Doc.Id 1750289 Page 20 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM make the data comprehensible for all registered users. The administrative court considers against this background that the measures taken by Spotify have not been sufficient to ensure that the personal data in the technical log files have were understandable. The provision of these has therefore not been compatible with the requirements of Article 12.1 of the Data Protection Regulation. Summary of Violations The administrative court has found the following. Spotify has not violated Article 15.1 a-c or 15.1 g. The information in these however, parts have been provided in such a way that there is a violation of Article 12.1. Spotify has violated Article 15.1 d and 15.2. However, IMY has not been able to show that information in these parts has been provided in violation of Article 12.1. Spotify has further violated Article 12.1 as the measures taken did not have been sufficient to ensure that the personal data in the technical the log files have been understandable. Choice of penalty for violations of Spotify's general procedures Conditions for imposing a penalty fee The question then is whether, due to the violations found, Spotify should an administrative penalty fee is imposed. Spotify states in this part that if an intervention is to take place, it should be imposed the penalty charge is changed to a reprimand. It is undisputed that the violations is of low severity. In this context, they must also be considered to have taken place for only a short period of time. Nor have they caused any damage in Doc.Id 1750289 Page 21 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM meaning of the data protection regulation. Spotify may also be considered to have done what could be expected from the company in terms of technical and organizational measures. The fixed penalty fee also amounts to just over 1 percent of the maximum penalty fee. In such circumstances one must choose a different penalty as a starting point. Furthermore, it is not necessary to impose a sanction on Spotify to ensure compliance with data protection regulation. IMY has also not shown that Spotify's alleged violations have been committed intentionally or through negligence, which is a prerequisite for a penalty fee to be imposed. The violations have have not been possible to predict with regard to the practice, information and adopted guidance that was available at the time. Against the background of this neither has nor should Spotify have had reason to assume that the handling would constitute a violation of the data protection regulation. Spotify thus has was unaware that the action constituted a violation. IMY states that all circumstances that were significant for the assessment of both the choice of penalty and when determining the amount of the penalty fee has considered. That IMY clarified how the degree of seriousness has been assessed is not one circumstance that militate against imposing a penalty fee on Spotify. The categorization of the infringement as one of low seriousness is to be understood against background of the EDPB's guidelines, whereby a relatively low sanction amount within it the current span should be selected as the starting point. IMY has further under all circumstances showed that Spotify was negligent to a sufficient degree. It should thereby it is particularly emphasized that it is Spotify that has developed routines and processes for handling data subjects' access requests. It is also Spotify which has produced and designed the information provided to data subjects who requested access to their personal data from Spotify. IMY has not claimed that Spotify has intended the violations in question, but it is in any case clear that the company has acted with negligence when it was not alive up to the requirements set by the data protection regulation in the relevant respects. Doc.Id 1750289 Page 22 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM The Administrative Court makes the following assessment. According to Article 58.2 of the Data Protection Regulation, each supervisory authority has power to impose administrative penalty charges in accordance with Article 83 in addition to or instead of the measures referred to in Article 58(2), depending the circumstances of each individual case. Article 83.2 states which factors must taken into account when determining whether a penalty fee should be imposed and whether the size of the amount. Recital 148 of the data protection regulation states, among other things, following. To strengthen the enforcement of this regulation should be imposed sanctions, including administrative penalty fees, for violations of this regulation in addition or in lieu of the appropriate action taken by the regulatory authority accordingly with this regulation. In case of a minor violation or about it penalty fee likely to be imposed would involve a disproportionate burden on a natural person, a reprimand may be issued instead penalty fees. Spotify has violated the data protection regulation by not providing sufficient information according to Article 15.1 d and Article 15.2 as well as by other information that has been provided under Article 15 in several respects has not been compatible with the requirements of Article 12.1. The administrative court considers that it taken together cannot be considered a minor violation. One penalty fee cannot therefore be replaced by a reprimand. In order for a penalty fee to be imposed, it is also required that the personal data responsible party was at fault in the sense that the personal data controller did not can be considered to have been unaware that the action constituted an infringement (EU the Court's judgments of 5 December 2023 in cases C-683/21 and C-807/21). Doc.Id 1750289 Page 23 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM As a personal data controller, Spotify has a responsibility for that personal data processing is compatible with the requirements that follow from data protection regulation. The Administrative Court has assessed that the violations of Article 15.1 d and 15.2 is because Spotify has not satisfied the registered right to information as it follows from the wording of the article and the reasons for it data protection regulation. The violation of Article 12.1 regarding the information submitted according to Article 15.1 a-c and 15.1 g, it also depends on an action which was in conflict with requirements that could clearly be deduced from the data protection regulation as well as its reasons. The administrative court considers that, against this background, Spotify does not may be considered to have been ignorant that the action in these parts has involved a violation of the data protection regulation. There are therefore conditions for to impose an administrative penalty fee on Spotify due to these violations. As regards the violation of Article 12.1 which consisted in Spotify's failure to act sufficient measures to ensure that the personal data in the technical the log files have been comprehensible, however, the administrative court considers the following. Of the investigation shows that Spotify has taken relatively extensive measures on its own initiative measures to make the technical log files comprehensible. As stated above, it is also undisputed that the detailed description has been sufficient so that a data subject can understand the data in the log files. Spotify has also assisted the registrant with translating the description if necessary as well as provided clear information about this possibility. With regard to that Spotify undisputedly stated that only a few requests for translation have produced, it may be considered that there was no reason for the company to believe that the taken the measures have not been sufficient to make the data comprehensible for all registered. At the time of the violation, it was also missing more detailed guidance on the matter. The Administrative Court assesses against this background that Spotify may be considered to have been unaware that the action in this part involved a violation of the regulation. This violation shall therefore not be taken into account the calculation of the amount of the penalty fee. Doc.Id 1750289 Page 24 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM The size of the penalty fee To assess the amount of the penalty fee, the administrative court will take position on the seriousness of the violations and whether there are aggravating factors and extenuating circumstances. In the assessment, all relevant circumstances specified in Article 83.2 of the Data Protection Regulation are taken into account. According to Article 83.1, the imposition of the penalty fee must also be effective, proportionate and dissuasive. In this part, Spotify brings forward, in addition to what was stated in the previous section, i.a. following. The imposed penalty fee is not in reasonable proportion to those the alleged violations. IMY has not sufficiently considered them many mitigating circumstances that apply in the case. Although the penalty fee is a seemingly small part of the maximum amount that can is determined according to the data protection regulation, the fee in absolute terms is a lot high. The Administrative Court makes the following assessment. The established violations of the data protection regulation have meant that data subjects have not been able to acquire basic information about how their personal data is processed. The violations have affected a very large number of registrants. The shortcomings in the provision of information have also in large extent affected data subjects' opportunities to check whether their personal data is handled in a correct and legal manner and by extension their opportunities to exercise their rights according to the data protection regulation. Spotify's personal data processing also covers a large amount personal data, even if these do not belong to those particularly worthy of protection categories of personal data specified in Article 9 of the Data Protection Regulation. Doc.Id 1750289 Page 25 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM When assessing the seriousness of the violations, However, the administrative court also emphasized that Spotify on its own initiative and before the supervisory case was initiated has taken extensive technical and organizational measures to improve their procedures in order to provide correct information according to Article 15. It is undisputed that this work has since been carried out continuously and that the routines have been improved. The administrative court also considers, i contrary to IMY, that the period of six months that the violations have been ongoing cannot be considered a period of time of such length that it entails that the seriousness of the violations increases. It is further undisputed that the violations has not been done intentionally. However, this only means that the seriousness of violations do not increase due to intent. There is no support for that assess that the seriousness of the violations is reduced as a result of their not having occurred intentionally (see the Court of Appeal in Stockholm's judgment of 16 September 2022 in the case No. 7837-21). The administrative court finds in a balanced assessment that the violations, based on the categorization that must take place according to the EDPB's guidelines, is of low severity level. A penalty fee of between 0 and 10 percent of that the applicable maximum amount, which in the current case is SEK 5,280 million, shall therefore determined (cf. the EDPB's guidelines on the calculation of administrative penalty fees according to the General Data Protection Regulation, adopted on 24 May 2023). IMY has also considered the violations to be low degree of seriousness and assessed that in light of Spotify's high turnover there is reason to adjust the starting point for the calculation of the penalty fee downwards. The Administrative Court shares this assessment. The question then is whether there are mitigating or aggravating circumstances which has significance for the size of the sanction amount. Circumstances that have taken into account when assessing the seriousness of the infringements shall not considered again. Doc.Id 1750289 Page 26 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM In mitigation, IMY has above all placed importance on the fact that registered persons have had the opportunity to contact Spotify's customer service through several different channels in order to receive additional individualized information. Furthermore, Spotify has in June 2022 done updates to the Article 15 information for data subjects to understand it specific personal data processing applicable to their uniqueness use of the service. There are no additional aggravating circumstances brought forward. The administrative court considers that IMY has taken the mitigating factors into account circumstances that apply in the case and that there is no reason to do so any other assessment in this part. In summary, the administrative court thus considers, similarly to IMY, that the violations are of low seriousness and that there are some mitigations circumstances. IMY has set the penalty fee at SEK 58 million. Unlike IMY, however, the administrative court has judged that Spotify does not has violated Article 15.1 a-c and 15.1 g, nor Article 12.1 in all the aspects stated in the appealed decision. Administrative law has also assessed that Spotify may be considered to have been unaware that the provision of technical log files was not compatible with the requirements of Article 12.1, therefore this violation shall not be the basis for the imposition of a penalty fee. The has not emerged other than that IMY has taken these violations into account at the determination of the amount of the penalty fee. This speaks according to the opinion of the administrative court that the violations cannot be considered as a whole be as serious as IMY has assessed. The penalty fee must therefore be set down. The Administrative Court notes that the violation of Article 12.1 regards the technical log files seem to have led to an increase in the penalty fee with three million kroner. Otherwise, it is not clear to what extent respectively violation has affected the size of the penalty fee. The administrative court finds in a summary assessment of the violations severity and the mitigating circumstances of the case that Doc.Id 1750289 Page 27 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM the sanction fee shall be set at SEK 40 million. The amount is only to approximately 0.75 percent of the maximum penalty fee that may be levied. Taking into account the very high turnover that is the basis for the calculation of the sanction fee, however, the administrative court considers that this amount is still effective, proportionate and dissuasive. Case processing time Finally, the question is whether there is reason to lower the penalty fee as well due to the processing time of the case. Spotify states that the extended processing time should mean that someone penalty shall not be issued. The handling has, among other things, consisted of two longer sub-periods about a total of almost two years of inactivity on the part of the authority. The long one the processing time constitutes a violation of the company's right to legal review within a reasonable time according to Article 6 of the European Convention. The company is consequently entitled to compensation under Article 13 of the European Convention, which should is left by not imposing a possible sanction at all or by one reduction of any penalty fee. In this assessment, particular taken into account that the long processing time has meant that a higher turnover has formed the basis for the calculation of the penalty fee. In this part, IMY presents, among other things, following. In light of the complexity of the matter the current processing time has not been unreasonably long. The case contains several complicated legal issues and has, due to the fact that the case is cross-border, entailed cooperation with all data protection authorities i EU. Furthermore, the investigation has included an examination of Spotify's general procedures and expanded to also include three individual complaints from three 2European Convention for the Protection of Human and Fundamental Rights the freedoms. Doc.Id 1750289 Page 28 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM different countries. Processing has also been delayed as a result of updates to the information covered by the review. During one of the time periods that Spotify has referred to as inactive ongoing i.a. intense discussions between data protection authorities in the EU on how cross-border complaints according to the data protection regulation would be handled. The discussions had direct significance for the current case. Furthermore, the processing time has not meant that a higher penalty fee has been determined. The sanction fee that has been imposed deemed effective, proportionate and dissuasive, both in percentage and nominally. That Spotify has had an increased annual turnover has therefore not had anyone greater impact on the size of the fee. The Administrative Court makes the following assessment. When assessing what is an unreasonably long processing time according to article 6.1 of the European Convention, the total processing time must be taken into account, how complicated the goal has been, the actions of the individual and the authority, if it has there have been longer periods of inactivity, as well as the importance of the matter to it individual (cf. the judgment of the European Court of Justice on 27 January 2015 in case no. 66232/10, Kincses v. Hungary p. 47 and HFD 2014 ref. 12). IMY's total processing time for the case has been approximately four years. According to dagboksbladet, communication in the matter has taken place continuously. However, it has there have been two longer periods without action on the part of IMY. The periods add up for a total of approximately two years. The administrative court considers that it is a question of relatively long periods without measures. However, IMY has submitted that it during the first period of inactivity a boundary crossing was in progress cooperation with other data protection authorities in the EU that were important to it the current case and that the case during this time was expanded to also refer to three complaints. During the second period, IMY produced a draft decision in the matter. In connection with the writing of the decision, however, attention was drawn to the fact that Doc.Id 1750289 Page 29 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM Spotify made significant changes to its Article 15 information which according to IMY contributed to the delay of the case. The Administrative Court considers that there is no reason to doubt that IMY, under the periods which appear from the diary sheet as inactive, have taken action i purpose of moving the case forward. The described measures can according to The administrative court's opinion admittedly does not fully explain the long one the delay of the case. However, the case raises several complicated issues legal issues and a relatively comprehensive basis. According to administrative law, the total processing time can be set against this background is not considered to have been unreasonably long. Spotify's right to a legal review within a reasonable time according to Article 6.1 of the European Convention has therefore not violated. There is thus no reason to put down on this basis the penalty fee. Regarding what Spotify stated about the processing time led to a higher turnover being the basis for the calculation notes the administrative court that it appears from the appealed decision that IMY, with due to the high turnover, has chosen to adjust the starting point down for the calculation of the penalty fee. Complaint IMY has also assessed that Spotify should be reprimanded as a result of violations of the data protection regulation in the handling of two were registered access request. Complaint 1 Spotify disputes that the company has violated the data protection regulation in connection with the handling of the appellant's request for access except for violations of article 15.1 and 15.3 of the data protection regulation, by Doc.Id 1750289 Page 30 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM the company accidentally handed over encrypted personal data to the complainant. The however, was only a limited part of the personal data in the copy that was encrypted and the violation must be considered minor. The assessment of whether the appellant's request for access concerned all or only some personal data must further be made based on the information that Spotify left at the current time. If the complainant in question understood that the request was limited to certain personal data must be irrelevant. Of the information provided by Spotify at the time made it clear enough clearly that a registrant who used the "Download your data" tool did not get access to all their personal data. Because the appellant gained access to the requested personal data already the day after the request was made, Spotify can is not considered to have violated Article 12.3 of the Data Protection Regulation. It is further undisputed that at the relevant time Spotify did not provide any description of the personal data that existed in the form of technical log files. The however, it is contested that the lack of such provision would constitute a violation of the data protection regulation. In this part, IMY presents, among other things, following. The information provided by Spotify that the data subject gained access to "most" personal data such as Spotify processed cannot result in Spotify being considered to have provided sufficient information on how the copy of personal data was divided. This applies in particular as there was a lack of information about what additional information was available available and how this could be requested. Spotify should therefore have considered the request about access as a request to obtain all personal data. Appellant's action is further a circumstance that suggests that the information was not clear enough, but is not alone decisive. It is also clear that the information provided in encrypted format was so unclear that they could not be understood by the data subject. Spotify therefore has not gave the complainant access to his personal data in accordance with Article 15.1 and 15.3 i data protection regulation. This information has also not been provided in a summary, Doc.Id 1750289 Page 31 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM clear and distinct, comprehensible and easily accessible form, as prescribed in article 12.1 of the data protection regulation. The Administrative Court makes the following assessment. Article 15.3 of the data protection regulation states that it the personal data controller must provide the data subject with a copy of them personal data that is being processed. Article 12.3 states, among other things, to this copy shall be provided without undue delay and during all circumstances no later than one month after the request is received. As can be seen from the appealed decision, Spotify provides the copy on personal data in three different layers. At the time in question, one could registered use the "Download your data" tool to access one of the layers. In the tool it was stated that the registrant by downloading his data got access to "most" of their personal data. Information about which others personal data that Spotify handled or how the data subject could request access to these was lacking. The Administrative Court, like IMY, considers that based on the information that Spotify at the time left was difficult to understand if and in such cases how the copy of personal data was divided. A data subject who requested access to his tasks cannot therefore have been expected to understand that he only received access to a selection of these. With this in mind, Spotify should have managed the complainant's request as referring to all his personal data. Of the investigation shows that the complainant requested access to his personal data on 27 May 2018 and that he was given access to a copy of all of them data only on 17 July 2018. The Administrative Court divides against this background IMY's assessment that Spotify has thereby violated Article 12.3 i data protection regulation. Doc.Id 1750289 Page 32 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM The Administrative Court has further in the section the provision of personal data i in the form of technical log files deemed to be Spotify's duty to make comprehensible the personal data contained in technical log files. It is indisputable that someone description of this information has not been provided to the appellant in connection with that the copy of personal data was provided. Neither have the log files explained or otherwise made comprehensible. The Administrative Court considers that the provision of these has therefore been inconsistent with Article 12.1 i data protection regulation. In the copy of personal data provided to it registered, some information has also been encrypted. A registrant who takes against personal data in an encrypted format can according to the administrative law means not considered to have gained access to these in accordance with Article 15.1. Not nor has the registered person then received a complete copy of his personal data as prescribed in article 15.3. The Administrative Court considers that this deficiency thus constitutes a violation of both Article 15.1 and 15.3. The Spotify stated that there was only a limited number of data that was given out in encrypted format and that this happened by mistake does not cause anyone other assessment. In summary, the administrative court therefore agrees with IMY's assessment that Spotify has handled the complainant's request for access in breach of Articles 12.1, 12.3, 15.1 and 15.3 of the data protection regulation. Complaint 2 Spotify brings forward, in addition to what was stated in the previous section, essentially following. It is common ground that Spotify did not provide it to the appellant information prescribed in article 15.1 a–h and 15.2. The reason for this was that Spotify at the time of the alleged infringement did not automatically provided this information in connection with an access request. The however, it does not follow from the data protection regulation that a request for access to personal data necessarily needs to be accompanied by this information. Doc.Id 1750289 Page 33 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM The appellant's request in the present case was clearly limited to a copy of the personal data that was being processed. It must therefore be compatible with the Data Protection Regulation to only provide such a copy and not also the special information specified in article 15.1 a-h and 15.2. IMY states in this part that Spotify admits that it did not register was provided with the information prescribed in Article 15.1 a-h and 15.2. Previously, Spotify stated that it was a mistake that the information did not was provided to the appellant. However, Spotify believes in the appeal that it registrants in the present case had limited their request to the copy of personal data. What Spotify now presents appears as one post construction. IMY does not consider that it has emerged that the appellant gave any instruction to only access the copy of personal data. The complainant has used the referred channel to access his personal data and therefore had to expect that the answer he then received would give him access in the manner prescribed by the Data Protection Regulation. The Administrative Court makes the following assessment. In the previous section, the Administrative Court has assessed that Spotify, as far as it is concerned information that was provided to data subjects at the relevant time, should have handled a request for access as if it concerned all personal data which the company processed about the registered person. In the current case, the appellant has not provided a copy of all his personal data despite his request may be considered to have intended these. The Administrative Court shares IMY's assessment that Spotify has thereby violated article 15.1 and 15.3 of the data protection regulation. It is also undisputed in the case that the appellant has not received information either according to article 15.1 a-h and 15.2 of the data protection regulation in connection with its access request. The administrative court considers that the space for a personal data controller not to disclose this information is very small and Doc.Id 1750289 Page 34 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM that it presupposes that the data subject has clearly delineated his request to not refer to such information. That the registered in the current case would have demarcated his request in such a way has not emerged. Against this background, the Administrative Court assesses that Spotify has violated article 15.1 a-h and 15.2 by not providing information according to these regulations. In summary, the administrative court therefore agrees with IMY's assessment that Spotify has handled the complainant's request for access in breach of Article 15(1), 15.2 and 15.3 of the data protection regulation. Reprimand The administrative court has found that Spotify has violated the data protection regulation provisions in several respects when handling two data subjects' requests about access. The administrative court considers that there is no reason to do anything else assessment than the IMY made when choosing a penalty. Spotify must therefore be imposed one reprimand according to article 58.2 b of the data protection regulation. The administrative court further finds that Spotify should be ordered to do so regarding complaint 2 to accommodate the appellant's request for access in accordance with what is set out in the appealed decision within one month of this judgment becoming final force. Doc.Id 1750289 Page 35 ADMINISTRATIVE COURT JUDGMENT 13539-23 IN STOCKHOLM HOW TO APPEAL This decision can be appealed. Information on how to appeal can be found in appendix 2 (FR-03). Sofi Nyström Alderman The referees Birgitta Guntsch, Annicka Hörnsten Blommé and Ulf Wester has also participated in the decision. Administrative law prosecutor Mikael Stade has been the rapporteur. Doc.Id 1750289 Appendix 1 1(30) ADMINISTRATIVE LAW Spotify AB IN STOCKHOLM Section 8 Regeringsgatan 19 11153 Stockholm RECEIVED: 2023-06-30 TARGET NO: 13539-23 ACTIVE CAR: 3 Diary number: Decision after supervision according to DI-2019-6696 data protection regulation - Spotify AB Date: 2023-06-12 Table of Contents The Privacy Protection Authority's decision................................................... ............................3 Spotify's general procedures for handling requests for access............................3 Review of individual complaints................................................... ..........................3 1 Description of the supervisory matter ............................................... .....................................5 2 Applicable regulations................................................... ............................................6 3 Spotify's general procedures for handling requests for access - Justification of decisions ................................................ ................................................ ...................................7 3.1 Information - article 15.1 a-h and 15.2 of the data protection regulation................7 3.1.1 What emerged in the case ........................................... ..............7 3.1.2 The Privacy Protection Authority's assessment...................................8 3.2 The right to access personal data and a copy of personal data under processing - article 15.1 and 15.3 of the data protection regulation............................12 3.2.1 What has emerged in the case............................................. .......12 3.2.2 The Privacy Protection Authority's assessment...................................15 4 Review of individual complaints - Reasons for decisions............................................. ..20 4.1 Complaint 1 (from the Netherlands with national reference number z2018- 28415)................................................ ................................................ ..............20 4.1.1 Background................................................... ..........................................20 4.1.2 What has emerged in the case............................................. .......20 4.1.3 The Privacy Protection Authority's assessment...................................22 Postal address: 4.2 Complaint 2 (from Austria with national reference number D130.198) ......23 Box 8114 104 20 Stockholm 4.2.1 Background............................................ ............................................23 Website: www.imy.se 4.2.2 What has come to light in the matter................................. ............23 E-mail: 4.2.3 The Privacy Protection Authority's assessment...................................24 imy@imy.se 4.3 Complaint 3 (from Denmark with national reference number 2018-31-1198)26 Phone: 5 Choice of intervention................................................... ................................................ .......26 08-657 61 00 The Swedish Privacy Agency Diary number: DI-2019-6696 2(30) Date: 2023-06-12 5.1 Applicable regulations................................................... ............................26 5.2 Same or connected data processing.................................27 5.3 Deficiencies in information according to article 15.1 and 15.2 of the data protection regulation and in the description of the data in the technical log files............................27 5.4 Violations regarding complaints 1 and 2 ........................................... .......29 The Swedish Privacy Agency Diary number: DI-2019-6696 3(30) Date: 2023-06-12 The Privacy Protection Authority's decision Spotify's general procedures for handling requests for access The Swedish Privacy Protection Authority states that Spotify AB (556703-7485) under the period from and including 16 November 2021 to and including 16 May 2022 in the 1 information that must be provided according to article 15.1 and 15.2 of the data protection regulation does not provided sufficiently clear information about – the purposes of the processing, – categories of personal data to which the processing applies, – categories of recipients of the personal data, - the foreseen periods during which personal data will be stored or, if this is not possible, the criteria used to determine this period, - where personal data comes from, - appropriate protective measures when personal data is transferred to third countries. The Privacy Protection Authority further states that Spotify AB during the period from and with June 11, 2019 through May 16, 2022 by default do not provide the description of the data in the technical log files in English has met the requirements that all communications provided to the data subject pursuant to Article 15 of the Data Protection Regulation shall be clear and understandable in the manner specified in article 12.1 of the data protection regulation. Spotify AB has thus processed personal data in violation of articles 12.1, 15.1 a-d, 15.1 g and 15.2 of the data protection regulation. The Privacy Protection Authority decides with the support of articles 58.2 and 83 i the data protection regulation that Spotify AB must pay an administrative fee for these shortcomings sanction fee of 58,000,000 (fifty-eight million) kroner. Review of individual complaints The Swedish Data Protection Authority notes with regard to complaint 1 that Spotify AB in its handling of the appellant's request for access made on 27 May 2018 has processed personal data in violation of - Article 12.3 of the Data Protection Regulation, in that the copy of personal data has left too late, - articles 12.1, 15.1 and 15.3 of the data protection regulation, by in that copy on personal data provided by Spotify AB has not been provided to all of the complainants personal data in an understandable form. The Swedish Data Protection Authority notes with regard to complaint 2 that Spotify AB in its handling of the complainant's access request made on 10 October 2018 has processed personal data in violation of - articles 15.1 and 15.3 of the data protection regulation, by in that copy on personal data provided by Spotify AB has not given access to all personal data that Spotify AB processed about the complainant, 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regarding the processing of personal data and on the free flow of such data and on the cancellation of directive 95/46/EC (general data protection regulation). The Swedish Privacy Agency Diary number: DI-2019-6696 4(30) Date: 2023-06-12 - articles 15.1 a-h and 15.2 of the data protection regulation, by not having provided any of the information specified in these regulations. The Privacy Protection Authority gives Spotify AB a reprimand according to article 58.2 b i the data protection regulation for the deficiencies regarding complaints 1 and 2. The Swedish Privacy Protection Authority orders Spotify AB according to article 58.2 c in the data protection regulation that regarding complaint 2 no later than one month after this decision gained legal force accommodate the appellant's request for access by, with subject to any applicable exceptions in Article 15.4 of the Data Protection Regulation and 5 ch. data protection law, give the complainant access to all personal data that Spotify will process the complainant by providing the complainant with a copy of the personal data according to 15.3 and provide information according to articles 15.1 a-h and 15.2. 2 3 The complainant's identification information appears in Appendix 1 The Act (2018:218) with supplementary provisions to the EU's data protection regulation. The Swedish Privacy Agency Diary number: DI-2019-6696 5(30) Date: 2023-06-12 1 Statement of the supervisory matter The Swedish Privacy Protection Authority (IMY) has, in light of IMY's having taken note of complaints directed against Spotify AB (Spotify) regarding the right of access pursuant to Article 15 i data protection regulation, initiated supervision of Spotify with the aim of investigating the company's way of handling the data subject's request for access is in accordance with the data protection regulation regulations. IMY has initially reviewed the company's general procedures upon request about access and not what existed in the individual complaints. The review has been focused on whether the company's processes and routines to provide access according to article 15 on a general level enables data subjects to gain access to the personal data the company processes them and other information in accordance with the provision. With registered refers in this context to the customers who use Spotify's services and not other categories of data subjects, e.g. employees of Spotify. Within the scope of this review, IMY has not checked which personal data Spotify processes and if all of these are issued with each individual request. For example has any comparison between Spotify's records of processing pursuant to Article 30 i the data protection regulation and the personal data included in the copy of personal data according to Article 15.3 of the data protection regulation has not been done. IMY also does not have within the framework for this supervision reviewed whether Spotify's personal data processing otherwise complies the provisions of the data protection regulation, e.g. regarding basic principles and legal basis for the processing. The supervisory case was initiated with a supervisory letter on 11 June 2019. Response to the supervisory letter was received on 31 July 2019. On 16 October 2019 a request was sent about completion in the case. Response received on November 15, 2019. Spotify has subsequently on its own initiative received further additions on 25 August 2020 for the purpose to inform IMY of updates regarding procedures for handling requests for access. Spotify is an organization with operations and users in several EU member states. IMY has, taking into account that the case is cross-border, applied the mechanisms for cooperation and uniformity found in Chapter VII of the Data Protection Regulation. Every data protection authorities in the EU have been concerned supervisory authorities in this matter. With reason for the mechanisms of cooperation and uniformity, and the need for a 4 harmonized complaint handling within the EU, the IMY extended in November 2020 the ongoing general supervision to also include what existed in three individuals complaints, which also include the complaints that were initially the basis for them the supervision of the general routines. On November 5, 2020, IMY requested that Spotify explain its attitude towards them deficiencies alleged in the complaints and what steps Spotify has taken to respond on the respective request for access. Spotify has responded to IMY's request on 18 December 2020. Spotify has subsequently submitted supplementary statements, on 15 April 2021 in response to supplementary questions that IMY asked on March 24, 2021 as well as on 31 August 2021 in response to questions raised by IMY on 9 July 2021. 4 In 2020, the data protection authorities worked together to determine common working methods with the handling of complaints, which resulted in internal guidance that was established in February 2021. From that end the complaints with a standard response, IMY now makes an individual assessment of each complaint. Internal EDPB Document 02/2021 on SA's duties in relation to alleged GDPR infringements, adopted February 2, 2021. Data Protection Agency Diary number: DI-2019-6696 6(30) Date: 2023-06-12 On October 19, 2021, another request for completion was sent regarding Spotify's general procedures. Answer received on 12 November 2021. On 8 June and 17 In October 2022, Spotify has, on its own initiative, submitted further additions in purpose of informing IMY about updates regarding routines for handling the request about access. Spotify has commented on IMY's draft decision on 20 December 2022. IMY has then provided the other relevant supervisory authorities with the opportunity to comment accordingly Article 60 of the Data Protection Regulation. The French data protection authority has thereby expressed a relevant and reasoned objection to IMY's draft decision. Spotify has on March 13, 2023, an opportunity to comment on the objection and IMY's revised draft decision. Spotify's response was received on April 11, 2023. Against the background of the above, the supervisory matter includes an examination of Spotify's general routines for handling requests for access, partly a review of what existed in the three complaints. The general procedures regarding the provision of personal data according to article 15.1 and 15.3 of the data protection regulation which reviewed are those that have been in force since IMY's supervision began on 11 June 2019 up to and including 16 May 2022. Regarding the information according to Article 15.1 and 15.2 of the data protection regulation that must be submitted when a request for access has Spotify updated it several times since supervision began. IMY has therefore limited its review to the information that was valid during the period from 16 November 2021 through May 16, 2022. 5 2 Applicable regulations According to Article 15.1 of the data protection regulation, the data subject has the right to of it personal data controller receive confirmation as to whether personal data concerning him or her is being processed and in that case gain access to the personal data and information about a) The purposes of the processing. b) The categories of personal data to which the processing applies. c) The recipients or categories of recipients to whom the personal data has provided or to be provided, especially recipients in third countries and international organizations. d) If possible, the anticipated period during which the personal data will stored, or if this is not possible, the criteria used to determine this period. e) The existence of the right to request correction from the personal data controller or deletion of the personal data or restrictions on processing of personal data relating to the data subject or to object to such treatment. f) The right to lodge a complaint with a supervisory authority. g) If the personal data is not collected from the data subject, all available information about where this data comes from. h) The existence of automated decision-making including profiling according to article 22.1 and 22.4, whereby at least in these cases it must be left meaningful 5See Spotify's information according to Article 15 of the Data Protection Regulation in Appendix 2. Of the information, which was printed by IMY on 16 May 2022, it appears that the current website was last updated on 16 November 2021. The time period for the review is therefore set for the period from and including November 16, 2021 to and including May 16, 2022. The Swedish Privacy Agency Diary number: DI-2019-6696 7(30) Date: 2023-06-12 information about the logic behind as well as the meaning and the anticipated consequences of such treatment for the data subject. Article 15.2 of the data protection regulation states that if the personal data is transferred to a third country or to an international organisation, the data subject shall have the right to information on the appropriate protective measures that have been taken in accordance with Article 46 at the time of transfer. It follows from Article 15.3 of the data protection regulation that the person in charge of personal data must provide the data subject with a copy of the personal data that is being processed. Furthermore, it appears that if the request is made in electronic form, the information must, if not otherwise requested, provided in an electronic format that is generally used. Recital 63 of the data protection regulation states, as far as relevant, the following: The data subject should have the right to access personal data that has been collected this as well as being able to exercise this right in a simple way and at reasonable intervals, for to be aware that treatment is taking place and to be able to check that it is legal. (…) All data subjects should therefore have the right to be informed and notified above all, for what purposes the personal data is processed, if possible which time period the processing is in progress, who receives the personal data, underlying logic in connection with automatic processing of personal data and, at least when the processing is based on profiling, the consequences of such treatment. (…) It also follows from Article 12.1 of the data protection regulation that it personal data controller must take appropriate measures to ensure that all communications given to the registered under Article 15 must be in a concise, clear and clear, understandable and easily accessible form, using clear and unambiguous language. It follows from Article 12.2 of the data protection regulation that the person in charge of personal data must facilitate the exercise of the data subject's right of access under Article 15. According to Article 12.3 of the Data Protection Regulation, the personal data controller must request, without undue delay and in any case no later than one month after to have received the request, provide the registered information about the actions which was taken in accordance with Article 15 of the Data Protection Regulation. This period may if necessary be extended by a further two months, taking into account the complexity of the request and the number of requests received. The personal data controller must notify it registered for such an extension within one month of the receipt of the request and state the reasons for the delay. 3 Spotify's general procedures for handling request for access - Justification of decision 3.1 Information - article 15.1 a-h and 15.2 i data protection regulation 3.1.1 What emerged in the matter In summary, Spotify has stated the following. Spotify provides information in in accordance with article 15.1 a-h and 15.2 of the data protection regulation via an online function. This function is available in 21 different languages and those who visit the page will The Danish Data Protection Agency Diary number: DI-2019-6696 8(30) Date: 2023-06-12 automatically to be given the information in language based on language settings in their browser. Registrants who exercise their right of access are informed about the function in several ways. IN each copy of personal data provided pursuant to Article 15.3 i data protection regulation, a link to the information is included. The information also goes to find online, partly in the list of available functions on the company's page for "Integrity & Safety" partly via the answer to the question "Where can I find information about Spotify's processing of personal data that Spotify is obliged to provide under Article 15 of the GDPR?” on the company's page for "Personal data rights and privacy settings". In the information according to Article 15 of the data protection regulation that Spotify submitted the period from and including 16 November 2021 to and including 16 May 2022, as IMY taken note of, Spotify provided, among other things, information about the purpose of processing (article 15.1 a), which categories of personal data are processed (Article 15.1 b), recipients or categories of recipients (Article 15.1 c) and the source of the personal data (Article 15.1 g). In addition to that, the information according to Article 15 also contained information about international transfers (Article 15.2), criteria for how long the personal data saved (Article 15.1 d), what rights the data subject has (Article 15.1 e), the right to submit a complaint to the data protection authority (Article 15.1 f), automated decision-making (Article 15.1 h) and the possibility of obtaining a copy of personal data. In the information pursuant to Article 15 of the Data Protection Regulation, Spotify also informed that the processing of personal data is described in more detail in the company's privacy policy, which could also be accessed through a direct link. In the privacy policy can be found including descriptions of the categories of personal data that Spotify processes. Spotify has stated that all questions that are not answered by the information according to Article 15 i the data protection regulation or which has not been explained to the user in one satisfactory manner is promptly escalated to the company's data protection team. In that way, the company states, the data protection team is made aware of, and given the opportunity to respond, questions about clarifications or requests for more individualized information about the processing of personal data in accordance with Article 15 of the Data Protection Regulation. 3.1.2 The Privacy Protection Authority's assessment IMY states that Spotify's function for information according to Article 15 i the data protection regulation during the period that is the subject of review existed available on several different pages on Spotify's website. Furthermore, a link to was included the information in the "Read me first" file that was attached to each copy of personal data which was provided to the data subject in accordance with Article 15.3 i the data protection regulation in case of a request for access. IMY assesses with that in mind above that Spotify's routines during the relevant period were sufficient to ensure that information according to Article 15 was provided to the data subject at each access request. IMY further notes that Spotify's information according to Article 15 i the data protection regulation covered all the points of information that according to article 15.1 a-h and 15.2 of the data protection regulation must be provided to the data subject. For that the information must meet the requirements set in the data protection regulation must 6 See appendix 2 The Swedish Privacy Agency Diary number: DI-2019-6696 9(30) Date: 2023-06-12 however, the information is also designed in such a way that the purpose of the right of access is fulfilled. The purpose of the right of access is for the data subject to be aware that processing takes place and be able to check that it is legal, which is evident from reason 63 to data protection regulation. For example, a registered person must be able to check which categories of data are processed about him or her, for which purposes and for how long. So that the registered person can check if the processing of personal data is legal, he or she must know which treatments are are relevant in his or her specific case. The information provided must hereunder provided in a manner that meets the requirements for transparency in Article 12.1 i data protection regulation. Against the background of the purpose of the right of access, there is often a need to adapt the content of the information according to Article 15.1 and 15.2 i the data protection regulation to the data subject who has made the request, for example depending on which of the personal data controller's services the data subject has chosen to use. However, this does not apply to all parts of the information. While the right to enter complaints to a supervisory authority (Article 15.1 f of the data protection regulation) not changes depending on who requests access, other information may vary depending on which service the data subject uses, for example which categories of personal data processed, recipient and from where personal data was collected. The same applies to information about whether a transfer has taken place to a third country and if so what appropriate protective measures have been taken during the transfer. In order for the data subject to have the opportunity to check that the processing concerns him or her is legal it is therefore required, in accordance with what is stated above, that Spotify must have taken measures to adapt the information to that of the registrant 7 specific situation. IMY notes that the information provided by Spotify pursuant to Article 15 i the data protection regulation was generally designed. The same information was thus provided regardless of who requested access in accordance with Article 15 of the Data Protection Regulation. The information was thus not adapted based on each request for access. However described Spotify when certain information was relevant for the data subject, for example "If you use a third-party service (…)", "If you choose to pay for a service or function via invoice (…)” and “In cases where you have given us permission (…)”. There was thereby certain prerequisites for the data subject to determine which information meant him or her. There was also an opportunity for registrants to apply to Spotify and request more individualized information as well as clarification of it information that had been provided. IMY considers that such generally designed information may be suitable for standardized services that include personal data processing. Because they data subjects must understand how their personal data is processed, however, it must always be possible to clearly and simply read out which information is applicable in which situations based on the information provided. This means that the possibility for those registered to turn to Spotify for more individualized information as well as clarifications does not affect the assessment of whether the information here is sufficiently clear the respect. Generally designed information must not entail any ambiguities regarding 7 See the European Data Protection Board's (EDPB) guidelines on the right of access - Guidelines 01/2022 on data subject rights – Right of access, version 2.0 (finally adopted on 28 March 2023), paragraph 113. 8 See appendix 2 The Swedish Privacy Agency Diary number: DI-2019-6696 10(30) Date: 2023-06-12 whether the data subject is affected by the current information or not based on his individual situation. IMY therefore has to test the information that Spotify submitted met these requirements. Information on categories of personal data, purpose, recipient and source Information about the purpose of the processing must refer to the purposes for which it is data subject's personal data is actually processed, and must not consist of only one enumeration of different purposes without clarifying which purposes are relevant the person requesting access. Furthermore, information about the categories of personal data which is processed need to be adapted to the circumstances of the data subject who requests access. With regard to information about recipients or categories of recipients, such should information be as specific as possible. The data controller should normally state to which actual recipients the personal data has or is to be disclosed, if it is not impossible because, for example, there is no information yet about who the recipients are. In addition, all available information must be provided about where from the personal data will, if the personal data was not collected from it 9 registered. Regarding the information provided by Spotify about the purpose of the processing, recipient of personal data and source from which the data was collected states IMY that the information was divided based on different categories of personal data. These categories of personal data consisted of "user data", "usage data", "data about plan verification", "voting data", "payment and purchase data" and "competition, survey and lottery data”. The categories of personal data specified were generally held and contained none in several cases, for example regarding "user data" and "usage data". more detailed description of which personal data could be included. IMY considers that, especially in the absence of a clear description of the relevant categories, was not possible for the data subjects to, based on the information provided, understand which personal data which were included in the various categories. Because the information on purpose, recipient and source were divided according to these categories of personal data entails this shortcoming that it was also not possible for data subjects to easily understand which personal data processed for which purposes, which personal data taken from which source or which personal data was provided to a particular recipient or category of recipients. Those registered have thus not had the opportunity to read out in which way their personal data was processed. IMY therefore believes that Spotify has not provided sufficiently clear information about the purposes with the processing (Article 15.1 a of the data protection regulation), the categories of personal data processing applies (Article 15.1 b of the data protection regulation), recipients or categories of recipients (Article 15.1 c of the data protection regulation) or source from which the data was collected (Article 15.1 g of the Data Protection Regulation). The information was not concise, clear and clear, nor was it easily accessible. The thus also did not meet the requirements of Article 12.1 of the Data Protection Regulation. Information on storage period Information provided about how long personal data is stored must be sufficient specific so that the data subject understands how long his personal data will last to be stored. If it is not possible to specify the time of deletion, the relevant one should be used instead 9 Cf. the European Data Protection Board's (EDPB) guidelines on the right of access - Guidelines 01/2022 on data subject rights – Right of access, version 2.0 (adopted on 28 March 2023), paragraphs 114-120 and judgment of 12 January 2023 in EU- court case C-154/21, Österreichische Post.Integritetsskyddsmyndigheten Diary number: DI-2019-6696 11(30) Date: 2023-06-12 the event affecting conservation is specified, such as the expiration of a warranty period. The storage periods shall refer to the personal data that is linked the data subject requesting access. If this personal data is subject to different storage periods, information about the storage periods must be specified in relation to each current personal data processing and category of personal data. 10 Spotify provided information about storage periods under the heading "Criteria for retention of personal data”. The information contained general information about for which purposes the personal data is saved and criteria used to determine the storage periods. Among other things, it was stated that personal data as standard is retained for 90 days, unless a longer period is chosen due to a legitimate business reason. Furthermore, it was stated, among other things, that personal data is stored for a suitable period in order to deliver a personalized service over time and that streaming history is usually preserved during lifetime of an account. The information on how long data is kept was generally designed and, with exception, among other things, for the information about streaming history, not clearly linked to which categories of personal data were intended by the different storage times. The registrants could therefore find it difficult to decipher which of their personal data was preserved for what period of time. The criteria for determining the storage period which were stated in the information were furthermore in some cases very imprecise. It is for example difficult for a data subject to understand what was included in "legitimate business reason" and thus in which situations personal data was kept longer than 90 days or whatever meant that streaming history was "usually" preserved for the lifetime of an account. In an overall assessment, IMY considers that the information provided regarding storage periods did not meet the requirements in Article 15.1 d of the data protection regulation partly then the information in this part was generally designed and lacked connection to current category of personal data, partly then some of the criteria used to determining the storage period was too imprecise for the data subject to understand how long his personal data was stored. The information was not concise, clear and clear and also not easily accessible. It therefore also did not meet the requirements in the article 12.1 of the data protection regulation. Information on third country transfer In order for the registered person to be able to assess a possible transfer of his personal data to third countries is legal, the data subject must get meaningful information that makes it possible to find out whether his personal data has been transferred and if so, what safeguards have been used. To enable it was registered checking whether his or her personal data has been processed legally, it should i 11 it will normally also be clear to which third countries the transfer has taken place. In the information provided by Spotify regarding transfers to third countries it was clear under the heading "International transfers" that Spotify can share personal data globally with other Spotify Group companies, service providers, partners, etc. Further stated that Spotify ensures that the transfer is carried out in accordance with the applicable data protection and privacy laws and that technical and organizational measures, and i in particular, appropriate protective measures are applied, e.g. the standard contract clauses which 10 European Data Protection Board (EDPB) guidelines on the right of access - Guidelines 01/2022 on data subject rights – Right of access, version 2.0 (finally adopted on 28 March 2023), paragraph 118. 11 Cf the Article 29 Group's Guidelines on Transparency under Regulation (EU) 2016/679, WP260rev.01, adopted by European Data Protection Board, p.40. Data Protection Agency Diary number: DI-2019-6696 12(30) Date: 2023-06-12 approved by the European Commission when personal data is transferred from European economic cooperation area (EEA). IMY states that the information provided by Spotify regarding third country transfers was generally designed and not linked to the registered own situation. It was not clear whether the data subject's personal data had transferred to any third country, and if so, what appropriate safeguards were in place taken at the time of transfer. It was also not clear to which third countries the transfer had happened. IMY therefore assesses that the information provided regarding third country transfers did not meet the requirements of Article 15.2 of the Data Protection Regulation. The information was not concise, clear and clear, nor was it easily accessible. The thus also did not meet the requirements of Article 12.1 of the Data Protection Regulation. Summary assessment of the information according to Article 15.1 and 15.2 i data protection regulation In summary, IMY finds that the information provided by Spotify according to article 15.1 and 15.2 of the data protection regulation during the period between 16 November 2021 up to and including 16 May 2022 has been deficient in the above-mentioned respects. Spotify has thus processed personal data in violation of articles 12.1, 15.1 a-d, 15.1 g and 15.2 of the data protection regulation. 3.2 The right to access personal data and a copy of personal data under processing – article 15.1 and 15.3 i data protection regulation 3.2.1 What has emerged in the case Spotify has stated that their response to access requests, with a few exceptions, is designed to disclose all personal data that they process regarding it registered. The company has further explained its routines to ensure that all personal data is disclosed, for example when new or updated personal data processing. The copy of personal data provided by Spotify in accordance with Article 15.3 i the data protection regulation can be given through three different answers, Type 1, Type 2 and Type 3. The personal data covered by Type 1 is profile information and the personal data which Spotify has deemed to be of greatest interest to those registered. In Type 1 is included therefore, it recorded playlists, streaming history and recent searches the year, objects saved in the registrant's library, the number of followers of the registrant has, the number of users the registrant follows, the names of artists the registrant follows, user data and payment information. To give the registrant access to Type 1 information, the company has introduced a function called "download your data" on a privacy settings web page. The web page through which the data subject can access to this information is available to all customers via their Spotify account and provided in the same language as their Spotify service. Those registered may access to the Type 1 information within about seven days. Those registered can also get access to the Type 1 information by contacting Spotify's customer service. Type 2 information consists of technical log files that are stored in Spotify's system linked to the data subject's user ID. To access the Type 2 information the data subject can send a request via Spotify's web form for privacy issues or by contacting customer service or Spotify's data protection officer through someone Date: 2023-06-12 other channel (email, Facebook, Twitter or letter). It takes about two to four weeks to compile and disclose this personal data. Type 3 information consists of the information that a registered person specifically requests and can for example, refer to the data subject's listening history on a particular date, an extended listening history or a request for unstructured personal data, for example a request for certain email correspondence. Type 3 information can be requested on the same way as Type 2 and such a request normally takes less than 30 days to process. In case it takes longer to process the request, due to the complexity of the request, the registered person is informed of the delay. On 15 June 2021, Spotify implemented changes which mean that all Spotify users who request a copy of personal data beyond what is available in "Download your data" tool, or which directly requests a copy of all its personal data from Spotify's customer service, get access to extended streaming history as well as technical log information in one package. Spotify has stated that the design of the process and its development up to today are one aggregate result of joint discussions, careful considerations and analyses as well as meetings with relevant customer service and development teams. Spotify's data protection team has provided advice regarding legal requirements and "best practices" in data protection and continues to continuously update these based on a number of identified parameters, encompassing, among other things, relevant and current legislation, guidance, the ability to quickly respond to a large number of requests, ease of use and categories of personal data that is processed. Spotify has stated that they have over 232 million monthly active users and that during the period from 25 May 2018 to 30 June 2019 they answered 753,575 requests about access. According to Spotify, the division of data into three different types has done so possible to provide a quick and easy way for the data subject to download them personal data that is likely to be most relevant to the data subject and to generate answer in large measure and with the speed required to satisfy the majority of those registered. 12 Spotify further refers to statements in the EDPB's transparency guidelines that it i data protection regulation there is an inherent tension between the requirements to provide the recorded extensive information on the one hand and that the information should be given in one concise, clear and clear, comprehensible and easily accessible form on the other hand, that one must determine how to prioritize information that must be provided to data subjects and which levels of detail and methods are suitable for conveying the information and that the principle of openness is an overarching obligation. Spotify believes that these guidelines has relevance for the design of a concise, open, easy to understand and easily accessible process for data subjects to exercise their rights under Article 15 i data protection regulation. By providing three layers of response to requests for access to registered, Spotify intends to balance the data protection regulation's interests on one correct way in favor of Spotify's registrants. Spotify's goal is to provide correct information in accordance with Article 15 to all data subjects at the right time by provide information in different layers and in different ways. Spotify has stated that the company informed registered users that it was possible to request access to more personal data than those covered by Type 1 and Type 2, as well as 12Article 29 Working Party Guidelines on Transparency under Regulation (EU) 2016/679, WP260rev.01, as adopted by European Data Protection Board, point 1 and point 34. Data Protection Agency Diary number: DI-2019-6696 14(30) Date: 2023-06-12 that this information was provided to data subjects before they requested access to theirs personal data. Furthermore, Spotify has stated that it appeared that those registered could request access to more personal data than those covered by Type 1 by request a Type 2 response. In addition, registered users could contact Spotify's customer service with special requests (so-called Type 3 request). The information about this is provided in different ways way, including on the website for "Personal data rights and privacy settings" and on the website where information according to Article 15 i the data protection regulation is published. When a user requests access to the personal data covered by Type 1 by going to "Download your data" is further according to Spotify clearly from the context that users get access to a selection of their personal data and not all their personal data. On the "Download your data" page there is also a reference to the web page "Personal data rights and privacy settings”. For requests according to both Type 1 and Type 2, information is given according to article 15 of the data protection regulation which contains a comprehensive description of available data. The information sources also explain that the user can request access to their personal data via customer service or by contacting Spotify via email. If a user contacts Spotify's customer service to exercise the right of access according to article 15 of the data protection regulation, customer service can explain all three types of personal data that is available and inform users about it further information that is available. Those registered were also informed that they could request access to more personal data than they have already downloaded on the website "Understand my data". Furthermore, during the processing of the case, Spotify has updated the information that directs itself to the data subjects in order to make it more transparent for data subjects that it exists more to request than what is available in the "Download Your Data" tool. With regard to the clarity of the information, Spotify has essentially stated the following. At designing the access request response format the company focused on provide all information in a way that makes it relevant, transparent and helpful for those registered. The company developed a routine to ensure that the descriptions of the personal data is correct and complete, which included extensive efforts for to translate technical information into a simple language that can be understood by a average customer, however, without removing such details as are necessary for transparency. To facilitate understanding, Spotify does, among other things, the following. - When downloading Type 1 information, the registered person also receives a so-called "Read Me First" file. In the "Read Me First" file there is a link to the web page "Understand my data", where the format and personal data included in Type 1 are described. This one page has been updated during the processing of the case to now also include one general description of the data in the technical log files and the extended the streaming history. The linked pages are automatically displayed on the customer's preferred one language based on the language setting in the customer's browser. - In the Type 2 information, which consists of technical log files, there is some information which is highly technical in nature. To help data subjects understand the formatting of the personal data Spotify provides a detailed description of the personal data in a special file in connection with the data provided (in a “Read Me First” file for Type 2 requests). This description provided by default in English. Spotify also answers customers' questions about the significance of the personal data provided, as part of its process for access request was registered. Spotify also continuously updates both 13From June 15, 2019 comprehensive Type 2 information, in addition to the technical log files, also expanded listening history. The Swedish Privacy Agency Diary number: DI-2019-6696 15(30) Date: 2023-06-12 the format of technical log files attributable to the customer's user ID (Type 2) and corresponding information in the Type 2 “Read Me First” file to increase transparency based on the questions asked. – As regards special requests (Type 3), when the personal data which provided may require explanations, Spotify may, if necessary, leave the information in an e-mail to the data subject together with the copy of the personal data. Spotify has stated the following as background to the description of the Type 2 data by default is left in English. To ensure that the information that the company providing the registrants are correctly translated into their local language they are sent files to be translated by manual translation to professional translators. Against background of technical log data changing more dynamically over time than others personal data that is collected, the company would have to send the extensive "Read me First” file on translation several times a month. This would be disproportionate and unreasonable to do for all local languages given the extra time, resources and administration it would entail. Furthermore, many of the words have appear in the technical log data typically no translation because they often reflect technical concepts communicated primarily in English and usually not translated into local languages. However, the company helps with translation the information into local language if a user requests it to the extent they the technical terms are translatable. Spotify has further stated that they have responded to approximately 340,000 requests to access technical log files. Of these requests, only two registrants have turned to the company and requested one translation of the description into their local language. Spotify further believes that translation of the technical log files without request would mean that all data subjects would have to wait longer to obtain their right of access by the technical the log files accommodated. In terms of which format is used, Spotify has stated that the personal data provided in JSON format which, according to the company, is a structured and widely used format that can be understood by both computers and humans. Data provided to however, following a Type 3 request is provided in the format needed to respond request. Spotify has further informed IMY on 17 October 2022 that the company has since the time allowed for data subjects to request access to account data, extended streaming history and technical log information directly through "Download your data"- the tool, i.e. without contacting customer service. These routines are not covered by IMY's review when the update has taken place after May 16, 2022. 3.2.2 The Privacy Protection Authority's assessment According to Article 15.1 of the data protection regulation, the data subject has the right to receive confirmation on whether the personal data controller processes personal data concerning him or her and in that case gain access to the personal data. The personal data controller has, according to Article 15.3, an obligation to provide the data subject with a copy of the personal data that is being processed. The right of access is the same regardless by who the data controller is but the way to handle a request for access may vary, among other things depending on the extent of the personal data that processed and the number of registrants. According to Article 12.2 of the Data Protection Ordinance, the personal data controller an obligation to facilitate the data subject to exercise their rights. The Data Protection Agency Diary number: DI-2019-6696 16(30) Date: 2023-06-12 The purpose of the right of access is for the data subject to become aware of it processing that takes place and be able to check that it is legal. The The data controller must therefore ensure that the copy of personal data provided contains all the personal data processed about it registered and is designed in a way that is comprehensible to the registered. Access to the personal data must be given in a way that meets the requirements for transparency in Article 12.1 of the Data Protection Regulation. The requirements placed on the design and content of the copy mean that they personal data controllers who process a large amount of data or data that is particularly difficult to understand, may need to take special measures when the information presented to those registered. Spotify, whose personal data processing is both extensive and complex, has taken develop special procedures for handling requests for access. The question is about these routines enable the company to provide access to the personal data they process in one way that satisfies the data subject's right of access. Division of the copy of personal data into different layers Spotify divides the copy of personal data into different layers, Type 1, Type 2 and Type 3. IMY believes that there is no obstacle to dividing the copy of personal information in this way as long as the right of access is satisfied. In some situations, on the contrary, it can help the registrant to absorb the information if it is presented separately, in any case when it is a matter of an extensive amount of information. The provision of the copy on however, personal data in different layers must neither restrict the right of access nor make it difficult the exercise of it. The person in charge of personal data must therefore take this into account in particular the assessment of whether it is an appropriate measure to divide the copy of personal data. A data subject who addresses a personal data controller to request access to their personal data normally lacks knowledge of which personal data actually treated. Acquiring this knowledge is instead often the purpose itself request. If the personal data controller in this situation only provides it registrant with a selection of his personal data, the registrant risks that is led to believe that the copy provided is complete. For this reason, IMY considers that the personal data controller, in the channel he has established so that the data subject can request access, must be clear that the copy of the personal data is divided into different layers. It must also be clear to it recorded what information is in the various layers and in what way registrants can access these.4 In the report Spotify has submitted, it appears that the registered, in several different channels, receives information that access to different personal data can be requested in different ways. Through these channels it appears that access to "your most relevant personal data" can obtained through the "download your data" function as well as access to technical log information, extended streaming history or responses to other specific data protection requests may be obtained upon request via e-mail or customer service. IMY can, of those reported in the report the examples, state that the information provided to the registered also contains 14 Cf. The European Data Protection Board's (EDPB's) guidelines on the right of access - Guidelines 01/2022 on data subject rights – Right of access, version 2.0 (finally adopted on March 28, 2023), point 146. The Swedish Privacy Agency Diary number: DI-2019-6696 17(30) Date: 2023-06-12 an overall enumeration of which personal data the various types of requests include. IMY assesses that the information provided by Spotify in this regard, during that period which the review of the general routines refers to, is sufficiently clear that it data subjects must understand how the copy is divided, including what information is contained in them the different layers, and how the different layers should be requested. To set up special conditions for the exercise of the right of access without support i the data protection regulation risks causing the data subject to be unduly hindered in their exercise of the right. In other words, it can be perceived as unnecessarily complicated to exercise the right, which in turn may result in the data subject refraining from requesting out all information to which the registered person is entitled. There are reasons to underline that the personal data controller, according to article 12.2 of the data protection regulation, has a obligation to facilitate the exercise of the data subject's rights. In order to the provision of the copy of personal data in different layers shall not entail that the right is restricted or that the exercise of the right is made more difficult, IMY therefore considers that it cannot be required that the data subject returns to the personal data controller on several occasions to gain access to all personal data. Nor can it be complicated to request access to the various layers. IMY therefore considers that it registrants must be able to request access to all warehouses from the beginning and that it should be easy to access these. Another thing is that the registered, with the knowledge of how the data is divided, can still choose to only request access 15 to one or more layers. From Spotify's statement, it appears that the registered person can request access to the various the layers in different ways. It is not required that the registrant returns to Spotify to take part of the different layers. However, the data subject may have to take several measures in order to get access to several layers, e.g. by both downloading Type 1 information through function "download your data" and by requesting access to Type 2 and Type 3 information through customer service. If the data subject contacts customer service directly with their request, the data subject can request access to all personal data at the same time. IMY considers that the fact that the data subject must take various measures for requesting the various layers of data may cause some inconvenience. The registered however, has the opportunity to take all of these actions at one and the same time. All measures can also be taken easily via Spotify's website. At an overall assessment, IMY believes that Spotify's routines enable the registered to request access to all their personal data in a sufficiently simple way. The design of the copy and format of the copy It follows from Article 12.1 of the data protection regulation that the information provided according to Article 15 of the Data Protection Regulation must be given in a concise, clear and understandable, understandable and easily accessible form using clear and unambiguous language. What requirements should placed on clarity in the individual case must be assessed against the background of the purpose of the right of access, i.e. that the data subject must become aware of the treatment which takes place and be able to check that the processing is legal. 1 Cf. The European Data Protection Board's (EDPB) guidelines on the right of access - Guidelines 01/2022 on data subject rights – Right of access, version 2.0 (finally adopted on March 28, 2023), point 146. The Swedish Privacy Agency Diary number: DI-2019-6696 18(30) Date: 2023-06-12 The majority of the data that Spotify processes, especially when it comes to data in the technical log files, are by their very nature very technical as they contain e.g. codes and numbers. Such information can be difficult for the average data subject to understand. To to provide such information without further explanation would, according to IMY, not live up to the requirements for clarity, in terms of the purpose of the right. Because the data to provided in accordance with Article 15.1 of the Data Protection Regulation and covered by a copy according to article 15.3 of the data protection regulation shall be the personal data which is processed, however, it is not permitted for the personal data controller to change difficult-to-understand personal data to facilitate understanding. Such data can instead need to be explained. Spotify provides, together with the copy of personal data, additional descriptions for to make the data in the various layers comprehensible to the data subject. Spotify responds also on the data subject's questions about the meaning of the personal data provided and updates its general procedures and descriptions based on the questions that are asked. IMY believes that data in the technical log files that Spotify provides can be complicated to understand, despite the descriptions provided by Spotify. IMY believes however, that by providing these descriptions, Spotify enables it registered, albeit with some effort, to assimilate the information. That it despite descriptions, some effort may be required by the data subject to understand some particularly complicated tasks are a natural consequence of the nature of these tasks. By default, Spotify provides only the detailed description of the data in the technical log files in English. Neither Article 12.1 nor Article 15 i the data protection regulation contains an explicit requirement in which language personal data, or the description thereof, must be provided to the data subject. However, IMY believes that it follows from the purpose of the right of access and the requirements for clarity i article 12.1 that the registered should be able to receive the information in a language they know, i at least when the personal data controller directs its activities to countries where this constitutes an official language. This means that the personal data controller must take sufficient measures to ensure that the data subject understands the information. Spotify provides the majority of information provided to registered according to Article 15 of the Data Protection Regulation, including a general description of what the technical log files may include, based on the language settings in the individual's web settings, i.e. the local language. Further Spotify leaves clear information, in the local language, about the possibility to request translation of the description of the technical log files in the "Read Me First" file which provided with each request for access. This information is also provided at the local the language on the "Understand my data" webpage. Spotify has thus taken extensive measures to provide information in a language that the data subject must know comprehend. However, Spotify has reported significant difficulties in translating the description of the data in the technical log files to all local languages in them countries to which they direct their operations. The difficulties have their basis in the constant the changes to the data in the technical log files and the fact that many technical concepts can hardly be translated from English. 1Cf the Article 29 Group's Guidelines on Transparency under Regulation (EU) 2016/679, WP260rev.01, adopted by European Data Protection Board, point 13 and the European Data Protection Board's (EDPB) guidelines on the right to access – Guidelines 01/2022 on data subject rights – Right of access, version 2.0 (finally adopted on 28 March 2023) point 142. The Swedish Privacy Agency Diary number: DI-2019-6696 19(30) Date: 2023-06-12 However, IMY notes that Spotify has stated that, at the request of a data subject, they have possibility to translate the description of the data in the technical log files into one local language to the extent that the technical terms are translatable. Since a translation is therefore possible in practice, IMY believes that such a translation should can be provided even before a request for translation has been made from one registered. Spotify's stated difficulty in translating the description, including that translation may need to be done on several occasions each month and the additional ones resources this requires, cannot justify leaving the description as default either in English. Considering the purpose of the right of access, it is crucial that it data subjects understand which of their personal data has been processed in the technical the log files, which requires an understandable description of its content. IMY therefore considers that Spotify should have provided the description in local language already in connection with that the technical log files were provided to the data subject, at least to that extent it was necessary to understand the data in the technical log files. Against this background, IMY believes that Spotify has not taken sufficient measures to ensure that the data subject understands the description of the data in the technical the log files when this information is only provided in English by default. The information that Spotify provides in this part therefore did not meet the requirements that all communications provided to the data subject pursuant to Article 15 i the data protection regulation must be clear and understandable in the manner specified in Article 12.1 i data protection regulation. The fact that a data subject has the opportunity to return to Spotify to request a translation does not cure this deficiency. It follows from Article 15.3 of the data protection regulation that a data subject who makes a request if access in electronic form must receive the information in an electronic format that is generally used, unless the data subject requests otherwise. Spotify is leaving the data in JSON format. In the guidelines on the right to data portability, JSON format is given 17 as an example of a widely used open format. IMY states that the requirements set for formats are different for the right to data portability and the right of access when data portability according to article 20.1 of the data protection regulation also requires that the data be provided in a structured and machine-readable format format. In terms of the purpose of the right of access, IMY requires that the format in which the data is provided in accordance with Article 15 of the Data Protection Regulation must be possible to read for a natural person. However, there is nothing to prevent the format from also being machine readable. Such a format can in many cases make it easier for the registered person to make various summaries or searches to facilitate understanding. IMY believes that JSON format, which can be read by both computers and physical persons, i the current situation is such an electronic generally used format as referred to in Article 15.3 i data protection regulation. Summary assessment regarding the right of access to personal data and copy on personal data during processing – article 15.1 and 15.3 of the data protection regulation In summary, IMY finds that Spotify's way of dividing the copy of personal data in different layers does not hinder the exercise of the data subjects' rights and thus is in accordance with article 12.2 of the data protection regulation and that the design and format on the copy of personal data largely meets the requirements for transparency in Article 12.1 i data protection regulation. 1Article 29 Group Guidelines on the right to data portability, WP242 rev.01, adopted by the European the Swedish Data Protection Agency, p. 19. The Swedish Data Protection Agency Diary number: DI-2019-6696 20(30) Date: 2023-06-12 However, IMY finds that the description of the data in the technical log files which Spotify left during the period from and including 11 June 2019 to and including 16 May 2022 has not met the requirements of Article 12.1 of the Data Protection Regulation when this information by default has only been provided in English. Spotify has thus i in this respect processed personal data in violation of Article 12.1 i data protection regulation during the relevant time period. 4 Examination of individual complaints - Justification of decisions 4.1 Complaint 1 (from the Netherlands with national reference number z2018-28415) 4.1.1 Background The appellant has argued in summary that Spotify due to his the access request made on 27 May 2018 has not provided access to all of his personal data within the time prescribed in article 12.3 of the data protection regulation and that, once he has gained access to all personal data, these have not provided in an intelligible form in the manner prescribed in Article 12.1 i data protection regulation. 4.1.2 What has emerged in the matter Spotify provides three types of responses to ensure an appropriate and complete response response to its users' requests in accordance with Article 15 of the Data Protection Regulation. Spotify has stated that information about all three types of responses (Type 1, Type 2 and Type 3) as well as information on how to request access to them was available at the time of the appellant's request. In connection with a user choosing to load down its data (Type 1), was evident from the description and instructions in direct connection with the download tool that this was just a convenient way to get a copy of “the most" personal data from his account and which categories of personal data that were available through the tool. From the context it was therefore clear enough that other personal data was also available. The appellant also had the opportunity to contact customer service via several channels and request additional personal data. The complainant had also had the opportunity to turn to customer service and directly request access to all their personal data. Spotify believes that the process at the time was transparent enough to users would be able to understand as well as request additional available data in addition to those which was included in the "Download your data" tool. Many other users also requested both Type 2 and Type 3 tasks at that time. The appellant also succeeded in requesting and access both Type 1 and Type 2 information. Spotify has subsequently done the majority improvements in their processes to ensure that users cannot miss all three types of information available and how to easily request access to it the information. Spotify has stated that with regard to the provision of the complainant's personal data, so provided all requested personal data within the time frame specified in article 12.3 of the data protection regulation. "Download your data" (Type 1) was requested by complainant on 27 May 2018. The data was made available and downloaded by complainant on May 28, 2018. A response time of one day is consistent with Spotify's goal of quickly providing the most relevant information to users through their automatic tools. The Swedish Privacy Agency Diary number: DI-2019-6696 21(30) Date: 2023-06-12 Technical log files (Type 2) were requested by the complainant via email on 11 June 2018. In Spotify's response on July 6, 2018, Spotify informed the complainant that the provision of the personal data would take a little longer than expected due to the high number requests and the complexity of compiling such technical information. The information was made available for download on July 17, 2018. Even after having informed the appellant of the reason why the response would be delayed, only 36 elapsed calendar days (26 working days) between the complainant's request and the receipt of a response. Regarding the complainant's complaint regarding the format of the personal data, Spotify has stated that Type 2 data contains a large number of files with technical log data. What data is processed may differ significantly for different users based on what kind of Spotify service plan they have (eg Free, Premium, Family), features and the specific user's activity, as well as variations in the usual internal the processing and error logging of the Spotify software itself. Its a challenge to find a way to explain this kind of technical information in a way like that the average Spotify user can understand. At the time of the complainant's request, Spotify provided the information in a JSON format. However, Spotify did not provide any additional documentation to further clarify what types of data were included and how these should be interpreted (in addition to the information that appears in the JSON data fields themselves). Since 2019 however, Spotify provides a supplementary "Read Me First" file upon delivery of all Type 2 data, which further describes the information contained in each file and data field. Given the complexity and volume of the technical log files required the creation of the "Read Me First" file a lot of work, and Spotify had not yet completed this process at the time of the appellant's original request for access. It was a mistake to provide the appellant with some of the technical log files in encrypted format. Spotify stores data in its systems in encrypted format to reinforce the integrity and security in connection with the company's own internal processing of personal data. It was not Spotify's intention to withhold from the complainant personal data from him. Although most of the encrypted data was decrypted before being included in the appellant's technical log files, some of the fields were not decrypted. That kind of problem was fixed upon discovery of this, and now requested personal data is always provided unencrypted. Spotify wants to draw IMY's attention to the fact that the complainant requested their personal data again in July 2020. This request came after his complaint to IMY and the improvements as described above. The complainant received his personal data significantly faster than within 30 days. The complainant requested "Download your data" (Type 1) on 28 July 2020. Spotify provided the personal data three calendar days later, on July 31, 2020. The complainant also requested its technical log files (Type 2) on August 3, 2020 and downloaded the personal data when it was available 15 days later, on August 18 2020. Both of these requests were answered within a total of 18 days by Spotify and the complainant was able to receive all his personal data within a total of 21 calendar days. This one timeframe is representative of Spotify's handling of these types of requests from user. All technical information received by the complainant on August 18, 2020 was unencrypted. The complainant should also have received a "Read Me First" file as field by field explained the information provided. With the fulfillment of the appellant's latest request, Spotify hopes that all the complainant's questions regarding articles 12.1 and 12.3 of the data protection regulation that he raised in his complaint have been answered. The Swedish Privacy Agency Diary number: DI-2019-6696 22(30) Date: 2023-06-12 4.1.3 The Privacy Protection Authority's assessment As IMY states in the assessment of the company's general routines, section 3.2.2 i this decision, it is possible to divide the copy of personal data into different layers provided that the data subject has received sufficient information, among other things, about how the copy personal data is divided and how access to the various layers can be requested. The fact that the complainant claims that his personal data was not provided in time shows that the appellant must have considered that his initial request which was sent on 27 May 2018 referred to all personal data that Spotify processed about him. Of data such as the complainant left further states that he contacted Spotify because he himself noticed that the copy of personal data he received on 28 May 2018 was not full. The fact that he contacted Spotify was thus a consequence of those conclusions the appellant himself drew from the copy of personal data he received and not from on the grounds that the complainant understood Spotify's division of the copy into personal data and how access to additional data could be requested. These circumstances speak according to IMY for the information provided by Spotify at the time of the complainant the request regarding the division of the copy on personal data has not been sufficient clear. IMY also believes in an assessment of the information provided by Spotify description and instructions in connection with the appellant making his Type 1 request on 27 May 2018 that that information alone was not clear enough to the appellant should have understood that it was only a subset of the personal data which was covered by the request. At the time of the appellant's request, it was also missing information that is currently available on Spotify's website, including on the website for "Personal data rights and privacy settings", where it is clear which personal data given in the various responses, and how access to these can be requested. IMY further considers that what Spotify stated that the complainant could turn to customer service and requesting additional information is irrelevant as such action assumes that the complainant would have understood that there were additional personal data that could be released. In view of the above, IMY considers that Spotify, at the time of the complainant access request, did not provide sufficiently clear information for the appellant to understand that the copy of personal data was divided. That there is sufficient information for that a registered person must understand that his request only refers to a selection of them personal data that is processed is a prerequisite for the personal data controller must be able to limit the disclosure of this personal data. In case it is unclear about the request only concerns a selection of the personal data, so it should personal data controller assume that the registered person wants access to all of their personal data. Spotify should therefore, as the information in this regard was deficient at the time of the complainant's request, have disclosed all personal data that they dealt with the appellant in relation to his request for access made on May 27, 2018. The time within which Spotify had to leave the copy on all personal data must therefore be calculated from this time. Spotify would, according to the article 12.3 of the data protection regulation, have provided a full copy of the complainant personal data or notified the complainant of an extension of the time period at the latest on 27 June 2018. Spotify only notified the complainant of an extension on 6 July 2018 of the time period. The copy of the additional personal data was submitted on 17 July 2018. IMY states that Spotify did not announce the extension within the time that prescribed in Article 12.3 of the Data Protection Regulation. Spotify has therefore left the copy on the complainant's personal data too late. The Swedish Data Protection Agency Diary number: DI-2019-6696 23(30) Date: 2023-06-12 From the complainant's information, as confirmed by Spotify, it appears that they further personal data he gained access to on 17 July 2018 has been difficult to understand as well as, in some cases, encrypted. As IMY states under section 3.2.2, it is required that the personal data controller explains especially difficult to understand personal data so that the purpose of the right of access shall considered fulfilled. IMY notes that Spotify has not lived up to its obligations in the appellant's case as they have not provided an explanation for the particularly difficult to understand information they provided in the copy as well as when they have provided certain information encrypted. IMY states with regard to the above that Spotify in its management of the complainant's request for access made on 27 May 2018 has processed personal data in violation of article 12.3 of the data protection regulation, by making the copy on personal data has been submitted too late, as well as in violation of articles 12.1, 15.1 and 15.3 of the data protection regulation, by not having provided all the complainants personal data in an understandable form. 4.2 Complaint 2 (from Austria with national reference no D130.198) 4.2.1 Background The complainant has alleged that Spotify due to his request for access which was made on October 10, 2018 has not provided all the personal data that Spotify treats the complainant that Spotify has not provided any of it information on the processing of the complainant's personal data as required by Article 15.1 a–h and 15.2 of the data protection regulation and that Spotify has not provided the personal data in an understandable form in the manner prescribed in Article 12.1 i data protection regulation. The appellant has stated, among other things, that the information has provided in a format that is machine-readable only and not comprehensible to physical users people. 4.2.2 What has emerged in the matter Spotify has stated that the complainant requested access to "Download your data" (Type 1) on 10 October 2018. The data was made available and downloaded by the complainant on 18 October 2018. The complainant then never contacted Spotify again to bring them forward views raised in his complaint to the IMY. Nor did he request access to additional information beyond that made available through "Download Your Data"- the tool. Spotify provides three types of responses to ensure an appropriate and complete response response to its users' requests in accordance with Article 15 of the Data Protection Regulation. Spotify has stated that information about all three types of responses (Type 1, Type 2 and Type 3), as well as information on how to request access to them was available at the time of the appellant's request. In connection with a user choosing to load down its data (Type 1), was evident from the description and instructions in direct connection with tool that this was just a convenient way to get a copy of "most" personal data from his account and which categories of personal data were available through the tool. From the context it was therefore clear enough that other personal data was also available. The appellant also had the opportunity to contact customer service via several channels and request additional personal data. Spotify believes that the process at the time was transparent enough to users would be able to understand and request additional available data in addition to those Date: 2023-06-12 which was included in the "Download your data" tool. Many other users also requested both Type 2 and Type 3 tasks at that time. Spotify has subsequently done the majority improvements in their processes to ensure that users cannot miss all three types of information available and how to easily request access to it the information. At the time of the appellant's request, the specific web page had information according to article 15.1 a-h and 15.2 of the data protection regulation not yet created and such information was also not automatically included in the access request response. Spotify confirms that the complainant did not receive this information along with his Type 1- response in October 2018. Spotify notes that although the complainant did not receive the specific the information under Article 15 in connection with its request, the information was available for the complainant in Spotify's privacy policy. Spotify has further stated that the company had processes in place to provide additional information and take action in the event that their response would not be considered sufficient to fully respond to a data subject's access request. About the appellant had contacted privacy@spotify.com or Spotify's customer service team regarding their questions, they would have been happy to provide additional personal data and other information according to Article 15 of the Data Protection Regulation which he requested. It is true that the complainant's "Download your data" data was provided in JSON format. JSON is a recommended standard format that can be understood by both people and computers. The information in "Download your data" (Type 1) is largely self-explanatory based on the file and field names. Nowadays, Spotify provides however, also a detailed description of the data on the information web page, "Understand my data". 4.2.3 The Privacy Protection Authority's assessment As IMY states in the assessment of the company's general routines, section 3.2.2 i this decision, it is possible to divide the copy of personal data into different layers provided that the data subject has received sufficient information, among other things, about how the copy personal data is divided and how access to the various layers can be requested. The complainant has, as IMY understands it, wanted access to all the information that Spotify treats about him. However, the appellant has only requested access to Type 1- the data and has also not returned to Spotify for further information. According to IMY, the complainant's actions indicate that the information provided by Spotify at the time of the appellant's request regarding the division of the copy at personal data and how access to the various layers could be requested was not sufficient clear so that the complainant would understand how he would get access to all the information. IMY also believes in an assessment of the information provided by Spotify description and instructions in connection with the appellant making his Type 1 request on October 10, 2018 that that information alone was not clear enough to the appellant should have understood that it was only a subset of the personal data which was covered by the request. At the time of the appellant's request, it was also missing information that is currently available on Spotify's website, including on the website for "Personal data rights and privacy settings", where it is clear which personal data given in the various responses, and how access to these can be requested. IMY further considers that what Spotify stated that the complainant could turn to customer service and requesting additional information is irrelevant as such action requires that the Swedish Privacy Agency Diary number: DI-2019-6696 25(30) Date: 2023-06-12 the complainant would have understood that there were additional personal data that could be released. In view of the above, IMY considers that Spotify, at the time of the complainant request for access, did not provide sufficiently clear information for the appellant to understand that the copy of personal data was divided. That there is sufficient information for that a registered person must understand that his request only refers to a selection of them personal data that is processed is a prerequisite for the personal data controller must be able to limit the disclosure of this personal data. In case it is unclear about the request only concerns a selection of the personal data, so it should personal data controller assume that the registered person wants access to all of their personal data. Spotify should therefore, as the information in this regard was deficient at the time of the complainant's request, have disclosed all personal data that they processed about the appellant. IMY states that Spotify has not disclosed all of them personal data they processed about the complainant. Spotify has therefore not complied the requirements in articles 15.1 and 15.3 of the data protection regulation to give the data subject access to their personal data as the company has not provided the data subject with one full copy of the personal data that was being processed. The complainant has further stated that the personal data he has been given access to was difficult to understand. Spotify's response shows that at the time of the complainant's request a description of the information provided to the appellant (Type 1) was missing. IMY however, deems that the information provided pursuant to a Type 1 request is sufficient clear for the average user to be able to understand the data and that these therefore do not require any further explanation. IMY therefore believes that they personal data provided has been sufficiently clear to meet the requirements according to article 12.1 of the data protection regulation, i.e. that the information provided according to Article 15 of the Data Protection Regulation must be given in a concise, clear and understandable, understandable and easily accessible form using clear and unambiguous language. Some lack therefore has was not available regarding how clear the personal data provided to the appellant was where. However, IMY looks positively on the improvements that Spotify has implemented after this time, which can further increase the understanding of the personal data provided in Type 1 response. The complainant has further stated that his personal data was provided in a format which was only machine readable and not comprehensible to natural persons. Spotify has stated that the data was provided in JSON format. IMY believes, which also appears above below 3.2.2, that JSON format, which can be read by both computers and natural persons, i the current situation is such an electronic generally used format as referred to in Article 15.3 i data protection regulation. IMY therefore considers that there was no deficiency in respect of the format in which the information was provided to the complainant. The appellant has finally claimed that he did not receive information according to Article 15.1 a-h and 15.2 of the data protection regulation. Spotify has confirmed that the complainant did not receive this information together with the response to the request submitted in October 2018. Spotify has thus not fulfilled its obligation to, in connection with the appellant's request for access, provide information according to article 15.1 a-h and 15.2. The fact that information at the time of the complainant's request was available in the company's privacy policy leker not this deficiency. IMY concludes in summary that Spotify in its handling of the complainant's request if access made on 10 October 2018 has processed personal data in violation with article 15.1 and 15.3 of the data protection regulation, by not having given access to the Privacy Protection Agency Diary number: DI-2019-6696 26(30) Date: 2023-06-12 all personal data that Spotify processed about the complainant and in conflict with article 15.1 a-h and 15.2 of the data protection regulation, by not having provided any of the information set out in these regulations. 4.3 Complaint 3 (from Denmark with national reference number 2018-31-1198) The complainant has claimed that Spotify has not responded to the complainant's request access according to Article 15 of the data protection regulation made on November 12, 2018. The investigation into the matter has not shown that Spotify failed in its handling of the complainant request for access, which means that the complaint in question must be rejected. The receiving supervisory authority, i.e. the Danish data protection authority, shall therefore adopt the decision regarding this complaint in accordance with Article 60.8 of the Data Protection Regulation. The justification for the decision in this part is thus reported in a separate decision from it Danish Data Protection Authority. 5 Choice of intervention 5.1 Applicable Regulations In the event of violations of the data protection regulation, IMY has a number of corrective measures powers, including reprimands, injunctions and penalty charges. It follows from article 58.2 a–j of the data protection regulation. IMY shall impose penalty fees in addition to or in lieu of other corrective measures as referred to in Article 58(2) of the Data Protection Regulation, depending on the circumstances i each individual case. If a personal data controller or a personal data assistant, with respect to a and the same or connected data processing, intentionally or by negligence violates several of the provisions of this regulation, it may the total amount of the administrative penalty fee does not exceed the amount determined for the most serious violation. It appears from Article 83.3 i data protection regulation. Each supervisory authority must ensure that the imposition of administrative penalty charges in each individual case are effective, proportionate and dissuasive. The stated in Article 83.1 of the Data Protection Regulation. In article 83.2 of the data protection regulation, the factors that must be taken into account are stated in order to decide whether an administrative penalty fee should be imposed, but also what should affect the size of the penalty fee. The EDPB has adopted guidelines on the calculation of administrative penalty fees according to the data protection regulation which aims to create a harmonized method and principles 18 for calculation of penalty fees. 18EDPB's guidelines 8/2020 Guidelines 04/2022 on the calculation of administrative fines under the GDPR, final adopted on 24 May 2023. Data Protection Agency Diary number: DI-2019-6696 27(30) Date: 2023-06-12 5.2 Same or connected data processing As stated above, the IMY, in the review carried out by the authority, has Spotify's general processes and routines for providing access according to Article 15 i data protection regulation, found deficiencies in the information provided in accordance with Article 15.1 a–h and 15.2 of the data protection regulation as well as in the description of the data in them the technical log files provided by Spotify. Spotify has also failed in its handling of request for access in relation to two of the complaints IMY has reviewed, complaint 1 and complaint 2. The violations regarding the general routines relate to the information according to article 15.1 a-h and 15.2 of the data protection regulation, to the period from on November 16, 2021 through May 16, 2022 as well as, regarding the description of the data in the technical log files, to the period from June 11, 2019 to and with May 16, 2022. Request for access covered by the individuals the complaints were made on 27 May 2018 and 10 October 2018 respectively. IMY assesses among other things against this background that the violations refer to the general ones the procedures and violations relating to the two complaints do not constitute the same or connected treatments in the manner referred to in Article 83.3 i data protection regulation. However, IMY considers that Spotify's provision of information covered by article 15.1 and 15.2 of the data protection regulation and the provision of the description of the data in the technical log files are interconnected. The the assessment is made, among other things, against the background of the identified deficiencies in these parts relate to the requirements for transparency in the information that Spotify has provided to them registered according to Article 15 of the Data Protection Regulation under a partial coinciding time period. Furthermore, the complaints are deemed to be connected with each other. IMY must therefore decide on the choice of intervention partly for the identified deficiencies i Spotify's information according to article 15.1 and 15.2 of the data protection regulation and i the description of the data in the technical log files partly for the findings the deficiencies regarding the two complaints. 5.3 Deficiencies in information according to article 15.1 and 15.2 i the data protection regulation and in the description of the data i the technical log files IMY has assessed that Spotify has violated articles 12.1, 15.1 a-d, 15.1 g and 15.2 i data protection regulation. In light of, among other things, the fact that the violations have been able to affect a large number of registered users, that the violations have been going on for a long time and as the deficiencies in the information made it difficult for registered users to take advantage of their others rights according to the data protection act, it is not a question of minor violations. Spotify must therefore be charged a penalty fee for the violations in this part. IMY states that Spotify has violated articles covered by Article 83.5 i data protection regulation which means that a penalty fee of up to twenty million EUR or four percent of the global annual turnover in the previous financial year, depending on which value is higher, may be applied. When determining the maximum amount of a penalty charge to be imposed on a company should the definition of the term company be used that the EU Court of Justice uses at the Privacy Protection Agency Diary number: DI-2019-6696 28(30) Date: 2023-06-12 application of Articles 101 and 102 of the TFEU (see recital 150 i data protection regulation). The court's practice shows that this includes every unit that carries out economic activities, regardless of the legal form of the entity and the way of doing so financing as well as even if the unit in the legal sense consists of several physical or legal entities. IMY assesses that the company's turnover is to be used as a basis for calculating the administrative penalty fees that Spotify may impose are Spotify's parent company Spotify Technology S.A. From Spotify Technology S.A.'s annual report for the year 2022 it appears that the annual turnover in 2022 was approximately SEK 132,000,000,000. The highest sanction amount that can be determined in the case is four percent of this amount, approx SEK 5,280,000,000. When assessing the seriousness of the violations, IMY takes in addition to what is stated above, i.e. that the violations have been able to affect a large number of registered persons, that the violations has been going on for a long time and that the deficiencies in the information made it difficult for data subjects to exercise your other rights according to the data protection regulation, also taking into account the following. The violations have entailed a risk that the purpose of the right of access is then thwarted the deficiencies in the information provided made it difficult for data subjects to understand which of their personal data that has been processed and how. The registrant thus does not have nor had the opportunity to check whether the processing was legal. Spotify's processing of personal data further includes a large amount of personal data about each registered and affects many registered users in several different countries. However, as far as has come to light, the data processed are not such special ones categories of personal data specified in Article 9 of the Data Protection Regulation. Processing of personal data that takes place within the framework of a customer relationship at the provision of a music streaming service does not normally get large either consequences for the data subjects. IMY has further, despite the scope of Spotify's personal data processing, only received a few complaints regarding the company's handling access requests. It is also important that Spotify has a challenge in providing comprehensive information about complex personal data processing in a way that is comprehensible to the data subjects which entails difficult trade-offs to assess how the information should best be used is presented. Spotify has provided certain information in accordance with all points in Article 15.1 and 15.2 of the data protection regulation. Furthermore, Spotify has provided information about its processing of personal data on several pages on the company's website. Some information about how the personal data was processed can also be read from that copy personal data according to article 15.3 of the data protection regulation that Spotify has provided to the data subjects who requested access and which IMY has generally assessed meet the requirements for clarity in Article 12.1 of the Data Protection Regulation. The investigation into the matter further shows that Spotify, on its own initiative and before the relevant date supervisory case was initiated, has taken several measures and put in extensive work to produce, develop and improve processes regarding requests for access that shall be transparent for those registered. These processes and routines have since been developed and continuously improved. According to IMY, this suggests that Spotify intends to fulfill the right of access in a way that is transparent to the data subjects. It also has forward until last year, when the EDPB adopted guidelines on the right of access, was lacking in detail guidance on how the information should be provided and at what level of detail, among other things 19 European Data Protection Board (EDPB) guidelines on the right of access - Guidelines 01/2022 on data subject rights – Right of access, (adopted on January 18, 2022 for public consultation and finally adopted on March 28, 2023). Data Protection Agency Diary number: DI-2019-6696 29(30) Date: 2023-06-12 regarding the degree of individualization of the information to be provided according to article 15.1 and 15.2 of the data protection regulation and which language should be used in communication according to Article 15 of the Data Protection Regulation. Overall, IMY assesses, against the background of the reported circumstances, that they the violations in question are of low seriousness. The starting point for the calculation of the penalty fee should therefore be set relatively low in relation to the current situation the maximum amount. To ensure a proportional penalty fee in the individual case there are also reasons to further adjust the starting point for it already at this stage continue the calculation downwards, taking into account the high turnover involved basis for the calculation of the penalty fee. In addition to assessing the seriousness of the violation, IMY must assess whether it exists any aggravating or mitigating circumstances that become relevant the amount of the penalty fee. The circumstances which have already been considered at the assessment of the seriousness of the infringement cannot be reconsidered at this stage of the assessment. IMY assesses that there are no further aggravating circumstances that affect the amount of the penalty fee. As a mitigating circumstance, IMY attaches particular importance the possibility for those registered to contact Spotify's customer service through several different channels to receive further individualized information. Furthermore, Spotify has in June 2022 informed that the company has made updates to the information in accordance with Article 15 among other for the data subject to understand the specific personal data processing which is applicable to their unique use of the Spotify service. As for the shortcomings regarding Spotify's choice of language for the description of the data in the technical the log files, it is also important that data subjects have had the opportunity to turn to Spotify to have the description translated or explained in its local language and to Spotify provided clear information about this possibility in the "Read Me First" file which provided in connection with the data being provided to the data subject. Against the background of the seriousness of the violations, aggravating and mitigating circumstances and the high turnover in relation to those established the violations, the IMY determines the administrative penalty fee for Spotify at 58 000 000 kroner. In doing so, IMY has assessed that this amount, which corresponds to approximately 1 percent of the highest possible sanction amount that can be determined in the case, is effective, proportionate and dissuasive in the present case. 5.4 Violations regarding complaints 1 and 2 IMY has established that Spotify breached its obligations in relation to the complainants in complaints 1 and 2. However, IMY can state that the complainants in both cases have received access to some of their personal data in a timely manner. Spotify has further, when the appellant in Complaint 1 contacted them, were helpful in providing further information and answered questions. Regarding complaint 2, Spotify has not been made aware that the complainant considered that his request for access was not fully met. The appellant has did not turn to Spotify and stated that he was dissatisfied with the company's handling of his request for access why Spotify has had difficulty remedying the shortfall. IMY states that the violations currently in question did not include sensitive ones personal data. Spotify has further taken measures, albeit insufficient, in order to comply with the appellants' requests. Even if the complainants' right of access does not Date: 2023-06-12 have been fully met, the deficiencies that have been present are therefore of a less serious nature character than if the requests had been left unanswered. In an overall assessment, IMY finds that, regarding the violations in complaint 1 and 2, are minor violations and that there is therefore reason to waive from imposing a penalty fee on Spotify for the established violations herein part. Spotify must instead be given a reprimand in accordance with Article 58.2 b i data protection regulation. Spotify has stated that the company is happy to cooperate with the complainants directly in order to ensure that it has provided all the data and the information that the complainants searching as well as that it has answered their questions. From information that emerged in the case, the complainant in complaint 1 has turned to Spotify again in July 2020 and subsequently granted access in accordance with Article 15 of the Data Protection Regulation. The complainant received all his personal data, including an explanatory document about the personal data that was processed, within 21 days. The personal data that then were left unencrypted. When the appellant has had his request for access granted if there is no reason to order Spotify to grant access again in accordance with Article 15. Regarding complaint 2, no information has emerged that the complainant has received access to more personal data or more information after the response to the access request in October 2018. Spotify must therefore, with the support of Article 58.2 c of the data protection regulation, ordered to comply with the appellant's request for access pursuant to Article 15 i the data protection regulation by giving the complainant access to all personal data that Spotify processes about him by providing him with a copy of the personal data according to article 15.3 of the data protection regulation as well as information according to article 15.1 a-h and 15.2 of the data protection regulation. Spotify has thereby to take into account the exceptions to the right of access in Article 15.4 of the Data Protection Regulation and ch. 5 the data protection act that can be updated. IMY assesses that access should submitted within one month of this decision becoming legally binding. _____________________________ This decision has been taken by the general manager Lena Lindgren Schelin after a presentation by lawyers Karin Ekström and Evelin Palmér. At the final processing has also the head of justice David Törngren and the head of unit Catharina Fernquist participated. Lena Lindgren Schelin, 2023-06-12 (This is an electronic signature) Appendix Appendix 1 - complainant's identification details (complaint 2) Appendix 2 - Spotify's information according to article 15 of the data protection regulation, on 16 November through May 16, 2022 Appendix 3 – Information on payment of penalty fee Appendix 2 How to appeal FR-03 ________________________________________________________________ If you want the decision to be changed in any part, you can raise your appeal (read more about you appeal. Here you will find out how it is done. trial permission further down). 3. Talk about what evidence you want to refer to. Appeal in writing within 3 weeks Explain what you want to show with each piece of evidence. Send with written evidence that has not already The time is usually counted from the day that you received is in the goal. part of the written decision. In some cases count the time instead from the date of the decision. It applies to 4. Leave name and social security number or if the decision was delivered at an oral organization number. negotiation, or about the right at the negotiation Provide current and complete information gave notice of the date of the decision. about where the court can reach you: postal addresses, email addresses and phone numbers. For a party representing the public (to for example authorities) the time is always counted from If you have a representative, leave as well - the day the court announced the decision. agent's contact details. 0 • i Note that the appeal must have arrived 5. Send or submit the appeal to c administrative law. You can find the address in t into court when time runs out. o the decision. pp d ö What day does the time expire? d The last day for appeals is the same day of the week What happens next? A e as time begins to count. For example, if you received e part of the decision on Monday 2 March the time expires The Administrative Court checks that the appeal- o Monday, March 23. it came in at the right time. Has it come in for pp o If the last day falls on a Saturday, Sunday or late, the court rejects the appeal. The v means that the decision applies. a holiday, Midsummer's Eve, Christmas Eve or New Year's c evening, it is enough that the appeal is received o next weekday. If the appeal arrived in time, send P administrative court appeal and all T - documents in the case forwarded to the Court of Appeal. v in e How to do it Have you previously received letters through simplified a service, the Court of Appeal can also send a letter l 1. Write the name of the administrative court and e in this way. Island target number. – - F 2. Explain why you think the decision should d is changed. Tell us what change you want g k and why you think the Court of Appeal should v r r n in Page 1 of 2 n A www.domstol.se Trial permission in the Court of Appeal When the appeal comes to the chamber- the right, the court first decides whether the case must be taken up for consideration. The Court of Appeal grants leave to appeal in four different cases. • The court considers that there is reason to doubt that administrative the court ruled correctly. • The court considers that it is not possible assess whether the administrative court ruled correctly without addressing the goal. • The court needs to take up the case in order to provide guidance to other courts in legal the application. • The court considers that there is extraordinary reasons to raise the case of someone other reason. If you do not receive leave to appeal, it applies appealed the decision. Therefore, it is important that i the appeal include everything you want to bring forward. 5 0 Do you want to know more? 0 • n Contact the administrative court if you have k questions. You can find the address and phone number at v s first page of the decision. t m d More information is available at www.domstol.se. f d A e e l pp O D a r u O P T - v d e n g k e ISLAND – - F d a l e island f a in in Page 2 of 2 n A www.domstol.se