Norway Fines Xandr €8.5 Million Over Grindr User Data
The Norwegian Data Protection Authority has imposed an €8.5 million fine on Microsoft-owned Xandr for processing Grindr users' data without a valid legal basis.
The Norwegian Data Protection Authority has fined Microsoft-owned Xandr €8.5 million, according to the organization NOYB. The fine equals 92 million Norwegian kroner and is the highest ever issued by the authority.
The fine comes as a result of Xandr processing data belonging to users of the Grindr app without a valid legal basis. The data includes sensitive details, such as information about sexual orientation, which affords it additional protection under European privacy rules.
The decision stems from a 2020 complaint filed by NOYB and the Norwegian Consumer Council. The organization views the fine as a victory for personal data protection, noting that it is the highest ever issued by the Norwegian regulator.
This case puts pressure on advertising companies that rely on user data for targeted ads. Processing requires a clear legal basis, and any flaw in this foundation can turn into substantial fines and reputational damage.
What do these terms mean?
Data Protection Authority (DPA): The official body in each country that monitors the application of personal data protection laws and enforces penalties.
Legal basis: A legitimate reason under which rules permit a company to collect and process user data, such as explicit consent or legitimate interest.
Sensitive data: Personal data that requires heightened protection, such as health, religious, or sexual orientation information.
Weekly Newsletter
Read between the lines before everyone else. Decode the most important economic, tech, and decision-maker movements in the region.. in 5 minutes every Saturday.
