Norway Fines Xandr 92 Million Kroner Over Grindr Data

Norway’s Data Protection Authority has fined advertising technology company Xandr 92 million kroner for processing and relaying information about Grindr users that could reveal their sexual orientation. The regulator described the penalty as the largest it has issued. The decision concerns activity from July 2018 to April 2020, before Microsoft acquired Xandr. The authority said Xandr transmitted Grindr-related information through automated advertising auctions to potentially thousands of companies. In real-time bidding, advertisers can receive information used to target advertisements and bid for placement. The authority said users could not know which businesses might receive their information through the process. According to the regulator, Xandr and Grindr were joint controllers of the data. It found that Xandr could not rely on an assumption that Grindr had obtained users’ consent, and that Xandr was responsible for establishing its own lawful basis for processing the information. The authority said information identifying someone as a Grindr user could reveal sexual orientation, making it sensitive personal data.