Norway fines Microsoft's Xandr $9.6 million over Grindr data
Datatilsynet says the penalty is the largest it has ever issued, citing Xandr's handling of Grindr users' sensitive data.
Norway's Data Protection Authority, Datatilsynet, has fined Xandr, a Microsoft-owned advertising company, $9.6 million (NOK 92 million) for unlawfully processing and sharing sensitive data belonging to Grindr users in Norway, according to bleepingcomputer.com.
Datatilsynet said the penalty is the largest fine it has ever issued. The authority found that between July 2018 and April 2020, Xandr managed real-time advertising auctions inside Grindr that potentially exposed users' sensitive data, including information about sexual orientation, to thousands of companies.
According to the regulator, Xandr acted as a joint controller with Grindr at the time and did not verify that Grindr's consents were valid. Xandr now operates as Microsoft Advertising and was given three weeks to appeal the decision.
A Microsoft spokesperson said the investigation and its outcome focused on conduct that predates Microsoft's acquisition of Xandr. The company said it is reviewing the decision and assessing its options.
Origins of the case
In January 2020, the Austrian nonprofit Noyb, together with the Norwegian Consumer Council, filed the original complaint that led to the case, according to the facts behind the decision.
Quick answers
How much was Xandr fined in Norway?
Datatilsynet fined Xandr $9.6 million (NOK 92 million), the largest fine the authority has ever issued.
What period did the Grindr data processing cover?
The authority cited the period between July 2018 and April 2020, when Xandr managed real-time advertising auctions inside Grindr.
Can Xandr appeal the fine?
Xandr, which now operates as Microsoft Advertising, was given three weeks to appeal the decision.