Background information
Date of final decision: 13.12.2021
Cross-border case or national case: National case
Controller: Grindr LLC
Legal Reference: Legal basis (Article 6), Processing of special categories of data (Article 9)
Decision: Infringement of the GDPR declared and fine imposed
Key words: Data sharing, behavioural advertisement, special categories of data
Summary of the Decision
Origin of the case
In 2020, the Norwegian Consumer Council filed a complaint against Grindr claiming unlawful sharing of personal data with third parties for marketing purposes. The data shared was GPS location, IP address, Advertising ID, age, gender and the fact that the user in question was on Grindr. Users could be identified through the data shared, and the recipients could potentially further share the data.
Key Findings
The Norwegian Data Protection Authority concluded that Grindr has disclosed user data to third parties for behavioural advertisement without a legal basis. Further, the Authority has concluded that consent was the applicable legal basis in this case, but that the purported consents Grindr collected for sharing personal data with advertising partners were not valid.
Furthermore, the information about the sharing of personal data was not properly communicated to users. The Authority consider that this was contrary to the GDPR requirements for valid consent.
The Authority consider that data revealing the fact that someone is a Grindr user strongly indicates that they belong to a sexual minority. Data concerning a person’s sexual orientation constitutes special category data that merit particular protection under the GDPR. As the consents Grindr collected were not valid, Grindr could not lawfully share such data.
Decision
The Norwegian Data Protection Authority has imposed an administrative fine of approximately € 6.5 million for not complying with the GDPR rules on consent.
For further information: decision in national language
https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2021/gebyr-til-grindr/ (NO)
https://www.datatilsynet.no/en/regulations-and-tools/regulations/avgjorelser-fra-datatilsynet/2021/gebyr-til-grindr/ (EN)
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned