How a Deezer data export request took 11 months
2 July 2018 (ME) — I send an email to Deezer Support requesting access to my personal data in an electronic form, according to GDPR Article 15.
4 July 2018 (DEEZER) — They send me my username and email address and say that it’s all the personal data they have stored. In the next paragraph they say that they also have the IP address history, listening history and payment history, and that I can request a copy of that data (didn’t they just say that all my personal data was my name?).
4 July 2018 (ME) — I confirm that I’d like to request a copy of all the data, and I explicitly repeat the category of data they have (listening history, etc.).
4 July 2018 (DEEZER) —They confirm that they forwarded the request, but that it may take some time because of the volume of requests.
At this point, I forgot about my request. The ticket remains open, but nothing happens until I write to them some months later.
10 March 2019 (ME) — I send them a message in the same support ticket saying that I’m still waiting for the data export since the previous July.
11 March 2019 (DEEZER) — They are sorry it took so long, and they send me a CSV file of data until July 2018, which is when I sent the original request.
The CSV file is disappointing. It’s just a list of IP addresses I used to connect to Deezer in the past 8 years.
I’m pretty sure this cannot be considered “all they data” I gave them or they collected from me. Things like the payments history, listening history, playlists, favorite songs/albums are missing, and those really are personal data used for personalizing the service.
12 March 2019 (ME) — I specifically request other personal data:
Are you sure this is all the personal information that can be exported?
It just seems a list of IP addresses. But there’s much more, I think, like listening history and saved songs (for sure used for the Flow feature), payments history, connected clients, first and last name, birthday, linked social networks, etc.
14 March 2019 (DEEZER) — They say they made “a copy of my personal information” available for download in my Deezer acccount.
They also say that they have the IP address history, listening history and payment history, and that I can request a copy of that data. Wait, didn’t I already do that?
So the data export I’m now able to download is a TXT file instead of a CSV one. It contains a bit more information than before, by starting with my registration date, last login and so on:
Then there’s a weird table of “listening history”:
It’s truncated, though. I think it’s just the last 100 songs I listened to, or something like that. It goes back by just 2 days starting on 8 December 2018, which is the date when I last used Deezer for listening to music.
There are similar tables for transactions and renewals at the bottom of the file, but I’m less interested in them.
Anyway, this is definitely not all the data.
14 March 2019 (ME) — I confirm the full data export request.
Yes, I’d like to request all the data, including the “additional data”. I’d like to export every personal information, as stated twice already. It shouldn’t be this hard to explain…
21 March 2019 (DEEZER) — They confirm they forwarded the request to the relevant team.
18 April 2019 (ME) — I ask if there’s any news about the data export.
18 April 2019 (DEEZER) — They say they escalated my request, and that it might take some time because of the high volume of requests.
7 May 2019 (DEEZER) — The request is still being processed (I haven’t asked anything, I’m not sure which message they’re referring to).
15 May 2019 (DEEZER) — They say they have an Excel file that they want to give me, and that it’s accessible through an “SFTP server” (I will then discover that the server has nothing to do with the SFTP protocol).
They go on by listing the categories of data they exported, and by then mentioning some other legal things like who and how processes the data, etc. (omitted from the screenshot).
So… Let’s see where these “SFTP” credentials are. I go to the Deezer account page, as suggested, and download a file. It turns out that there are no “SFTP” credentials. What I find is a TXT file very similar to the one they exported the previous time, only that this time it seems it’s updated to 12 May 2019.
17 May 2019 (ME) — I ask them to clarify where I’m supposed to find these “SFTP credentials”.
17 May 2019 (DEEZER) — The request has been forwarded to the legal team.
29 May 2019 (DEEZER) — They fixed it, maybe?
Our legal team just had credentials to connect to the SFTP and updated your file. You should be able to access to your credentials now.
The TXT file now contains different information:
It seems that the SFTP server is in reality a web interface, that prompts me an username and password.
I try to the enter the “login” and “password”, but it doesn’t really work. It says that my username or password is incorrect 🤔.
29 May 2019 (ME) — I tell them that credentials seem to be wrong.
29 May 2019 (DEEZER) — They forwarded my request to the legal team.
6 June 2019 (DEEZER) — They sent another email to the legal team.
7 June 2019 (DEEZER) — They say that “the issue has been solved” and that credentials should now work.
I’m now indeed able to login on the SFTP website and download an Excel file of 2,41 MB. It contains 15 sheets, specifically:
- 1_creationData
- 2_customizationData
- 3_setupData
- 4_favoriteArtist
- 5_favoriteAlbum
- 6_favoritePodcast
- 7_favoritePlaylist
- 8_ favoriteSong
- 9_dislikedTracks
- 10_listeningHistory
- 11_playlistCreated
- 12_businessData
- 13_navigationData
- 14_tracking
- 15_telco
The most interesting one is the listening history.
It’s 55k rows of all the songs I listened in the past 8 years. Each row has the song information, the date/time I listened to that song, my IP address, the platform I used for listening (web, desktop, Android), the device I used (phone/computer model), and how many seconds I listened to each song.
Not every row has everything filled. For example, when using the desktop Electron application the name of the computer is not captured, or when using the web app the listening time is not recorded.
At this point, I’m satisfied. To conclude:
- I shouldn’t have waited that much after the original request in July 2018, but I think I forgot about it, or I didn’t bother to urge them to reply before March 2019.
- Deezer seems to be very confused. They sent me 3 incomplete exports until they finally gave me what I asked since the first email.
- It seems the process is somehow not automated. They need to have a legal team work on the request and produce a report, although I really hope the Excel file is produced with just a click of a button.
- The thing that you have to login to an “SFTP” website is a bit weird. They proved that they can make you download any file they want through the “Download” button in the account page, so why not put the Excel file there?
- In any case, always be kind.
