The Norwegian Consumer Council said that the national Data Protection Authority has reduced the fine imposed on dating app Grindr for sharing personal data without a legal basis from NOK 100 million to NOK 65 million. This follows the Consumer Council's 2020 complaint that Grindr collected and shared sensitive personal user data with several commercial third parties, who reserved the rights to pass on details to potentially thousands more companies for surveillance-based advertising.
Originally, the DPA announced a preliminary fine of NOK 100 million but this has been reduced to NOK 65 million after the DPA received further arguments from Grindr. There is a right to take the case to the Norwegian Privacy Appeals Board (Personvernnemda).
Policy director Finn Myrstad said the Consumer Council is pleased that the Data Protection Authority has upheld its complaint and found that Grindr had been operating in breach of the law. However, the council said authority’s final decision did not address its request for stronger sanctions
These sanctions would have required Grindr to declare which third parties have had access to private details and to provide information on their potential onward spread; delete all the personal data collected illegally and make sure third parties are told to do likewise; and ensure that users are no longer exposed to their private details being passed on to other firms.
Myrstad said this information was illegally collected and must be considered as particularly sensitive as it concerns users’ sexual orientation.
The Norwegian Consumer Council said that it had commissioned technical tests from the security company Mnemonic. Research on the advertising technology industry and specific data brokers was done with help from researcher Wolfie Christl at Cracked Labs. Other Grind app auditing was done by MetaX researcher Zach Edwards. The legal analysis and formal complaints were written with assistance from Noyb, the European digital rights group founded by activist Max Schrems.
