Grindr Fined NOK 65 Million (£5.4 Million) Following A Breach Of GDPR

Norway’s Data Protection Authority (DPA), Datatilsynet, found that Grindr had not complied with the EU’s General Data Protection Regulation (GDPR) and imposed an eye-watering fine of NOK 65 million, the DPA’s largest ever fine.

Legal basis of the fine

The legal basis of the fine was Grindr’s contravention of Article 58(2)(i) GDPR, for:

The DPA’s investigation

The DPA’s investigations into Grindr found that the company had disclosed to third party companies the personal data of their users including:

• Advertising and user ID;
• Age;
• Gender;
• GPS location; and
• IP address.

The personal information was shared for behavioural advertisement purposes but the DPA found that Grindr had not taken the appropriate steps to obtain the customer’s consent. Grindr argued that all users had to accept a privacy policy that included sharing personal data with third parties in order to use the app.

Self-proclaimed as the ‘world’s largest social networking app for gay, bi, trans and queer people’, Grindr’s responsibility to their users under GDPR must be followed to protect their users. The DPA explained that the nature of the app would identify the user as someone who belonged to a sexual minority and therefore likely to belong to a special category data and require additional protection under the regulations.

Article 9(1) GDPR provides that:

Article 9(2) GDPR includes exemptions as follows:

The DPA was not satisfied that Grindr’s forceful blanket approach in making all users accept a data privacy policy was enough to protect their users. Separate consents must be given to different personal data processing operations and so each user must be given genuine freedom of choice to choose what they consent to and what they don’t. Grindr should have therefore asked each user for specific consent for sharing their data for behavioural advertisement purposes and communicated this to each user.

Comment

Whilst the decision was made by the Norwegian DPA, the above case is a good reminder to companies in the UK to pay close attention to their GDPR responsibilities, especially if they process sensitive information of their users or customers.