Sweden: Administrative Court of Appeal upheld the SEK 58 million fine imposed on Spotify AB for noncompliance with GDPR provisions on data subjects' rights

On 3 June 2025, the Administrative Court of Appeal upheld the SEK 58 million fine imposed on Spotify AB for noncompliance with the General Data Protection Regulation (GDPR). The penalty was originally issued by the Swedish Authority for Privacy Protection (IMY) in June 2023, following an investigation initiated by a complaint. According to the Court, Spotify did not provide users with sufficiently clear and accessible information on how their personal data is processed, including details on data storage periods and safeguards applied during international transfers. These practices were found to restrict individuals’ ability to exercise their rights under GDPR.