The Norwegian Data Protection Authority has issued advance notification of a NOK 100 million fine to dating application Grindr, after a legal complaint from the Norwegian Consumer Council. The fine is 10 percent of Grindr’s global annual revenue. Grindr has until 15 February to submit comments on the decision to uphold the complaint for breaches of the General Data Protection Regulation (GDPR).
In 2020, the Norwegian Consumer Council revealed that many mobile apps collect and share large amounts of sensitive information without users' knowledge. Based on these findings, the council and privacy rights group Noyb filed legal complaints against Grindr and five commercial partners for breaches of the GDPR.
The Norwegian Data Protection Authority rules that Grindr users were not given sufficient information about how personal data were collected and shared with third party companies. Consumers had to accept data sharing with third parties in order to use the app, it added.
Finn Myrstad, director of digital policy at the Norwegian Consumer Council, said the council now expects Grindr to ensure that any personal information that was illegally collected and shared with third parties is deleted. Other companies and apps that engage in similar activities should ensure that they are operating in accordance with the legal precedence that has now been established, Myrstad added.
The council says that its revelations in 2020 led to more than 40 consumer and human rights organisations in the EU and US notifying their national authorities about the findings and calling for an end to "the data free-for-all".
Myrstad said the authority’s ruling establishes strict legal requirements on a whole industry that profits from collecting and sharing information about preferences, location, purchases, physical and mental health, sexual orientation and political views. There are examples of personal data being used to manipulate elections, and privacy breaches leading to scams or persecution, for example in countries where homosexuality is illegal, he added.
Monique Goyens, director general of The European Consumer Organisation (BEUC), said the decision sends a clear signal that it is illegal to monitor consumers without their consent around the clock and to collect and share their data. The GDPR "does have teeth", and consumer groups are ready to act against those who break the law, she added.
Ala Krinickyte, data protection lawyer at Noyb, said the ruling sends the message that "take it or leave it" is not consent, adding that this applies to many websites and apps.
