This article was collected and archived by Digital Sovereignty Watch from an institutional or public source relevant to digital sovereignty, technology policy, cybersecurity, cloud services, artificial intelligence or European regulation.
Data Sovereignty
Norwegian DPA fines Xandr EUR 8 600 000 for unlawful processing of personal data
The case started in 2020 when the Norwegian Consumer Council lodged a complaint against the technology company Xandr (at the time AppNexus, now a part of Microsoft) with the Norwegian DPA (Data Protection Authority). The Norwegian DPA has found it proven by clear preponderance of probability that Xandr processed Grindr users’ personal data, at least the fact that individuals were using Grindr, their ID and IP addresses, during real-time bidding. These are personal data under Article 4(1) GDPR and data concerning sexual orientation under Article 9(1) GDPR. Since the data were special category personal data, explicit consent under Article 9(2)(a) was the relevant legal basis for the processing. In light of the fact that the infringements concern some of the most central provisions in the GDPR, including sensitive data, the Norwegian DPA regards the infringements of high seriousness. for processing personal data of Grindr users in Norway without a legal basis in violation of Article 6(1) GDPR, and for processing special category personal data concerning sexual orientation without a valid exemption, in violation of Article 9(1) GDPR.