8 ms·

According to Spotify’s own site [0], their users have > ...the right to request a copy of your personal data in electronic format and the right to transmit tha

According to Spotify’s own site [0], their users have > ...the right to request a copy of your personal data in electronic format and the right to transmit that personal data for use in another party’s service... [0] https://www.spotify.com/us/legal/privacy-policy/#s3 https://www.spotify.com/us/legal/privacy-policy/#s3 Why can’t a transfer service just use that file? Perhaps, it doesn’t include playlists or liked artists/albums/songs?

tpmx 6y ago
I haven't tried doing so with Spotify, but basically it's typically too complicated and slow (see other comments) to be practically useful for the typical consumer of today.
tzs 6y ago
I've just requested my data. When I get it I'll take a look and see if it contains playlist information and either edit this comment or post a reply to myself if the edit window has closed with the results. They say it can take up to 30 days to process.
- morsch 6y ago
  Here's a previous discussion of someone getting the full dataset: https://news.ycombinator.com/item?id=17681289 https://news.ycombinator.com/item?id=17681289 Tried the GDPR data export from Spotify. By default, you get like 6 JSON files with almost nothing. After many emails and complaining and a month of waiting, I got a 250MB archive with basically EVERY INTERACTION I ever did with any Spotify client, all my searches. Everything.
- DaiPlusPlus 6y ago
  > They say it can take up to 30 days to process. What the heck... My current day-job is a multi-tenant SaaS system - every single entity in any of our heterogenous databases is tagged with a tenant identifier (it's also used in composite PKs/FKs in RDBMS databases to prevent incorrect inter-tenant references). Every database system we use (MSSQL, MySQL, Cassandra, etc) has some way to query itself (INFORMATION_SCHEMA, system_schema, etc) which allows for query-generation to generate queries that will reliably dump all data we have associated with any tenant (and by extension, any user) within seconds, even if there's been some ad-hoc or unplanned database design changes (this is the only time I use "SELECT *" in production code!) - this is from a weekend project where I wrote a simple web-application that generates and runs those queries and dumps data to CSV files for tables and JSON for document-stores, shoves them into a zip and uploads them to Azure Blob storage. I didn't build it for GDPR compliance but actually to allow me to undo any unintentional data-deletion without needing to do a full database restore. My operation's scale is nothing compared to Spotify - but if a tool I built in a couple of days can reliably dump all data about a subject across multiple independent cloud databases within seconds - what's Spotify's excuse?
  - draaglom 6y ago
    The 30 day figure is likely derived from the legal limit under GDPR for a Subject Access Request (one calendar month). Why commit to a tighter SLA than you legally have to?
    - ViViDboarder 6y ago
      Exactly. I’d be surprised if it actually takes 30 days, but there’s no point to them quoting something faster.
  - toast0 6y ago
    As someone else mentioned, there's a legal maximum, and I think a company is also held to their quoted timeframe (and they may be required to quote a timeframe as well). Additionally, having a delay can be useful to make it harder for someone to take over your account, and grab all your data; especially if there's sensitive data that might not be otherwise accessible or enumeratable through the UI or API.
  - tpmx 6y ago
    It's obviously not a technical problem. The 30 days comes from the GDPR legislation. Spotify is just behaving like an obnoxious child that needs a good smackdown from the EU. Howevever the GDPR also stipulates that this needs to happen without "undue delay". I'm not a lawyer specializing in EU law, but I think this wording was put there for the precise reason of being able to punish companies that behave like that. They'll get to them eventually.
    - jrockway 6y ago
      I don't think that's fair. If the law sets the limit at 30 days, there is no reason to do it sooner than 30 days. It is obviously a money-losing proposition to do it quickly, and the only reason it's an option at all is because of the law. I guess that makes it a reasonable compromise -- everyone is equally unhappy, but the world is a slightly better place. The reality is that "30 days" translates to "someone will run a script manually once a month" whereas something like "100 milliseconds" would force you to have automation. It's a reasonable tradeoff for rare events. There is a lot less engineering effort required, and that makes it cheaper.
- tzs 6y ago
  I got the results. It contains playlists.
input_sh 6y ago
I've done that. Ignoring that it takes a few days to receive a dumb, what you get is just a subset of data. I've been a Spotify user for over half a decade, but the oldest date I could find in the dump was a little over two years ago. I then contacted their support asking for all data, but I've made a mistake of contacting them with a wrong email address (which lead to them being unable to find my account) and I haven't bothered since. In the best case scenario, I'd say it takes a week to get the entire dump, which is not very convenient for switching to a competitor.
lxgr 6y ago
It doesn't include any standardized/machine-readable identifiers. For example, the Spotify API track-level responses always contain the ISRC [1], but the JSON files contained in the GDPR request don't. Spotify clearly does only the bare minimum required by the law and even actively frustrates GDPR requests by taking the maximum allowed time to respond to them. [1] https://en.wikipedia.org/wiki/International_Standard_Recording_Code https://en.wikipedia.org/wiki/International_Standard_Recordi...

tpmx 6y ago

I haven't tried doing so with Spotify, but basically it's typically too complicated and slow (see other comments) to be practically useful for the typical consumer of today.

tzs 6y ago

I've just requested my data. When I get it I'll take a look and see if it contains playlist information and either edit this comment or post a reply to myself if the edit window has closed with the results. They say it can take up to 30 days to process.

morsch 6y ago
Here's a previous discussion of someone getting the full dataset: https://news.ycombinator.com/item?id=17681289 https://news.ycombinator.com/item?id=17681289 Tried the GDPR data export from Spotify. By default, you get like 6 JSON files with almost nothing. After many emails and complaining and a month of waiting, I got a 250MB archive with basically EVERY INTERACTION I ever did with any Spotify client, all my searches. Everything.
DaiPlusPlus 6y ago
> They say it can take up to 30 days to process. What the heck... My current day-job is a multi-tenant SaaS system - every single entity in any of our heterogenous databases is tagged with a tenant identifier (it's also used in composite PKs/FKs in RDBMS databases to prevent incorrect inter-tenant references). Every database system we use (MSSQL, MySQL, Cassandra, etc) has some way to query itself (INFORMATION_SCHEMA, system_schema, etc) which allows for query-generation to generate queries that will reliably dump all data we have associated with any tenant (and by extension, any user) within seconds, even if there's been some ad-hoc or unplanned database design changes (this is the only time I use "SELECT *" in production code!) - this is from a weekend project where I wrote a simple web-application that generates and runs those queries and dumps data to CSV files for tables and JSON for document-stores, shoves them into a zip and uploads them to Azure Blob storage. I didn't build it for GDPR compliance but actually to allow me to undo any unintentional data-deletion without needing to do a full database restore. My operation's scale is nothing compared to Spotify - but if a tool I built in a couple of days can reliably dump all data about a subject across multiple independent cloud databases within seconds - what's Spotify's excuse?
- draaglom 6y ago
  The 30 day figure is likely derived from the legal limit under GDPR for a Subject Access Request (one calendar month). Why commit to a tighter SLA than you legally have to?
  - ViViDboarder 6y ago
    Exactly. I’d be surprised if it actually takes 30 days, but there’s no point to them quoting something faster.
- toast0 6y ago
  As someone else mentioned, there's a legal maximum, and I think a company is also held to their quoted timeframe (and they may be required to quote a timeframe as well). Additionally, having a delay can be useful to make it harder for someone to take over your account, and grab all your data; especially if there's sensitive data that might not be otherwise accessible or enumeratable through the UI or API.
- tpmx 6y ago
  It's obviously not a technical problem. The 30 days comes from the GDPR legislation. Spotify is just behaving like an obnoxious child that needs a good smackdown from the EU. Howevever the GDPR also stipulates that this needs to happen without "undue delay". I'm not a lawyer specializing in EU law, but I think this wording was put there for the precise reason of being able to punish companies that behave like that. They'll get to them eventually.
  - jrockway 6y ago
    I don't think that's fair. If the law sets the limit at 30 days, there is no reason to do it sooner than 30 days. It is obviously a money-losing proposition to do it quickly, and the only reason it's an option at all is because of the law. I guess that makes it a reasonable compromise -- everyone is equally unhappy, but the world is a slightly better place. The reality is that "30 days" translates to "someone will run a script manually once a month" whereas something like "100 milliseconds" would force you to have automation. It's a reasonable tradeoff for rare events. There is a lot less engineering effort required, and that makes it cheaper.
tzs 6y ago
I got the results. It contains playlists.

input_sh 6y ago

I've done that. Ignoring that it takes a few days to receive a dumb, what you get is just a subset of data. I've been a Spotify user for over half a decade, but the oldest date I could find in the dump was a little over two years ago. I then contacted their support asking for all data, but I've made a mistake of contacting them with a wrong email address (which lead to them being unable to find my account) and I haven't bothered since. In the best case scenario, I'd say it takes a week to get the entire dump, which is not very convenient for switching to a competitor.

lxgr 6y ago

It doesn't include any standardized/machine-readable identifiers. For example, the Spotify API track-level responses always contain the ISRC [1], but the JSON files contained in the GDPR request don't. Spotify clearly does only the bare minimum required by the law and even actively frustrates GDPR requests by taking the maximum allowed time to respond to them. [1] https://en.wikipedia.org/wiki/International_Standard_Recording_Code https://en.wikipedia.org/wiki/International_Standard_Recordi...