Norwegian DPA fines Xandr EUR 8.6 million for unlawful processing of personal data
The Norwegian DPA fined Xandr Inc. EUR 8,600,000 for processing personal data of Grindr users without a legal basis and for processing special category data concerning sexual orientation without a valid exemption.
- Framework
- GDPR
- Who it concerns
- Xandr Inc.
What changed?
Each point with the sentence from the source that says it.
The Norwegian DPA found that Xandr processed Grindr users' personal data, including advertising ID and IP addresses, during real-time bidding without a legal basis under Article 6(1) GDPR.
The Norwegian DPA has found it proven by clear preponderance of probability that Xandr processed Grindr users’ personal data, at least the fact that individuals were using Grindr, their advertising ID and IP addresses, during real-time bidding.
The DPA found that Xandr processed special category data concerning sexual orientation without a valid exemption under Article 9(1) GDPR.
The Norwegian DPA imposed an administrative fine of EUR 8 600 000 on Xandr Inc. for processing personal data of Grindr users in Norway without a legal basis in violation of Article 6(1) GDPR, and for processing special category personal data concerning sexual orientation without a valid exemption, in violation of Article 9(1) GDPR.
The DPA held that each joint controller must independently verify that consent is valid and covers its own processing.
The DPA holds that accountability cannot be outsourced; each joint controller must independently verify that consent is valid and covers its own processing.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Consent Management Policy
Review consent management procedures to ensure that when acting as a joint controller, the company independently verifies that consent obtained by another party is valid and covers its own processing.
- Data Protection Policy
Update the data protection policy to clarify that the company must have a legal basis under Article 6(1) GDPR for processing personal data in real-time bidding contexts.