Earlier quoted context omitted.
Frankly, I think a lot of this data isn't the users, but rather Spotify's. If Spotify didn't exist then the interaction data with it wouldn't exist. I don't see how it can possibly be "owned" only by the user here. Does a user "own" security footage in a store that they enter? Definitely not.
Damn - you bring up a good point. I wonder what a lawyer would say. Taking your thought one more step, what happens to the data the store creates thru a facial recognition system tied to the footage? Is that covered? I don’t know, but there are thousands of further permutations on his thought. Another reason I hate the GDPR (great intent, horrible execution).
So my (IANAL) understanding is: If the data is somehow tied to your real life identity, it's protected. E.g., the headphone brand might be protected because it's uniquely associated with your user account which is uniquely tied to a real-life identity.
I guess, whether or not the facial recognition output is protected, might depend on whether you want to use it to identify the person behind it - e.g., if it's an identifier to a database, it might be protected. If it's an emotion score or eye tracking analysis, it might not be protected, unless it's associated with your identity by some other process.