[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSEs_27g7fDdk7TYO5AmayXmz7GNvHFqUrjcH9neiXXs":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"4f05e0fe-97a4-4ea4-b9f8-c66cce225749","Datatilsynet (Norway) - 20\u002F03541-37","datatilsynet-norway-20-03541-37-b824a4","← Older revision Revision as of 11:22, 13 October 2026 Line 112: Line 112: }} }} The DPA fined Xandr NOK 92,000,000 (€ 8,500,000) because it processed personal data of Grindr users, amongst them special categories of data, without valid consent when it engaged in real-time bidding. Xandr acted as joint controller because of the complexity of real-time bidding that involves decision making of several parties involved. The DPA fined Xandr NOK 92,000,000 (€8,500,000) because it processed personal data of Grindr users, amongst them special categories of data, without valid consent when it engaged in real-time bidding. Xandr acted as joint controller because of the complexity of real-time bidding that involves decision making of several parties involved. == English Summary == == English Summary == === Facts === === Facts === The advertising technology company Xandr (controller, at that time AppNexus, now a part of Microsoft) engaged in so-called real-time bidding. Real-time bidding is a technology where advertisers can bid against each other via an automated process to show their personalised advert to a user of a website or app. It occurs every time a user visits a website or app where there is an available ad space. The advertising technology company Xandr (controller, at that time AppNexus, now a part of Microsoft) engaged in so-called real-time bidding. Real-time bidding is a technology where advertisers can bid against each other via an automated process to show their personalised advert to a user of a website or app. It occurs every time a user visits a website or app where there is an available ad space. Within this auction process, Xandr acted both on the buyer and seller side, meaning it provided both a supply side platform and a demand side platform. It offered to its clients a console, a tool to interact with its platform, where the clients were able to conduct, optimize and track their advertising transactions. Through the platform, Xandr receives ad requests of their clients and enriches the bid with information which segment(s) a user belongs to. The bid request is sent to advertisers who evaluate the request and decide whether to bid on the ad space. Real-time bidding requires the collection, accumulation and dissemination of personal data to target and personalise the advertisement and optimise the bid. The console offers settings where the clients of Xandr can exclude certain categories of data from bid requests or to exclude certain recipients from receiving bid requests. Within this process of real-time bidding at hand, Xandr processed personal data of Grindr users in Norway. Grindr is a dating app with a target market in the LGBTQ+ community. Amongst the data processed by Xandr was the information that individuals were using Grindr, their advertising ID, and IP addresses. This data was shared with third-party advertisers. Within this auction process, Xandr acted both on the buyer and seller side, meaning it provided both a supply side platform and a demand side platform. It offered to its clients a console, a tool to interact with its platform, where the clients were able to conduct, optimize and track their advertising transactions. Through the platform, Xandr receives ad requests of their clients and enriches the bid with information which segment(s) a user belongs to. The bid request is sent to advertisers who evaluate the request and decide whether to bid on the ad space. Real-time bidding requires the collection, accumulation and dissemination of personal data to target and personalise the advertisement and optimise the bid. The console offers settings where the clients of Xandr can exclude certain categories of data from bid requests or to exclude certain recipients from receiving bid requests. On the one side, Xandr provided assistance to Grindr to make its ad spaces available to potential buyers. On the other side, Xandr also operated on the demand side and send ad requests to third parties where an ad should be placed on the Grindr app, through an intermediary that had access controls within the console. Within this process of real-time bidding at hand, Xandr processed personal data of Grindr users in Norway. Grindr is a dating app with a target market in the LGBTQ+ community. Amongst the data processed by Xandr was the information that individuals were using Grindr, their advertising ID, and IP addresses. This data was shared with third-party advertisers. On the one side, Xandr provided assistance to Grindr to make its ad spaces available to potential buyers. On the other side, Xandr also operated on the demand side and send ad requests to third parties where an ad should be placed on the Grindr app, through an intermediary that had access controls within the console. The Norwegian Consumer Council lodged a complaint with the DPA on the basis of [[Article 80 GDPR|Article 80(1) GDPR]]. An additional complaint was filed regarding GDPR violations by Grindr. The Norwegian Consumer Council lodged a complaint with the DPA on the basis of [[Article 80 GDPR|Article 80(1) GDPR]]. An additional complaint was filed regarding GDPR violations by Grindr. Line 127: Line 131: === Holding === === Holding === The DPA found a violation of [[Article 6 GDPR|Article 6(1) GDPR]] and [[Article 9 GDPR|Article 9(1) GDPR]]. The DPA found a violation of [[Article 6 GDPR|Article 6(1) GDPR]] and [[Article 9 GDPR|Article 9(1) GDPR]]. The DPA held that the personal data processed (app name, app ID and app URL) were personal data pursuant to [[Article 4 GDPR|Article 4(1) GDPR]]. This is true for online identifiers that can make a natural person identifiable. The DPA held that the personal data processed (app name, app ID and app URL) were personal data pursuant to [[Article 4 GDPR|Article 4(1) GDPR]]. This is true for online identifiers that can make a natural person identifiable. As far as the role of Xandr as controller was concerned, the DPA held that Xandr acted as joint controller pursuant to [[Article 26 GDPR|Article 26(1) GDPR]] because it made decisions on the purposes and means of processing. While a processor may make certain decisions on the purposes and means, decisions of essential means are reserved to the controller. Joint controllership is assumed when the processing would not be possible without both parties’ participation in the purposes and means. As far as the role of Xandr as controller was concerned, the DPA held that Xandr acted as joint controller pursuant to [[Article 26 GDPR|Article 26(1) GDPR]] because it made decisions on the purposes and means of processing. While a processor may make certain decisions on the purposes and means, decisions of essential means are reserved to the controller. Joint controllership is assumed when the processing would not be possible without both parties’ participation in the purposes and means. When Xandr acted as advertiser and its platform placed ad buying bids to display ads on the Grindr app, it acted as joint controller with Grindr. In this process, ad buyers select a “segment” for a particular ad campaign. Xandr made available standard segments that the ad buyers could chose from. Therefore, according to the DPA, Xandr influenced the processing. When Xandr acted as advertiser and its platform placed ad buying bids to display ads on the Grindr app, it acted as joint controller with Grindr. In this process, ad buyers select a “segment” for a particular ad campaign. Xandr made available standard segments that the ad buyers could chose from. Therefore, according to the DPA, Xandr influenced the processing. When Xandr’s platform processed ad delivery and bid requests originating from Grindr, it acted partly as controller and partly as processor. Xandr maintained that it assumed the role of processor of Grindr, which is an assessment that is not supported by Grindr. The DPA considered that Xandr pursued its own objective of being a facilitator of exchanges between publishers and advertisers that involves data processing on its multi-sided platform. It was Xandr that defined the infrastructure and constraints for those exchanges. Xandr had an interest both when it came to the number of participants in that exchange system as well as when providing precise marketing and maximising value for advertisers and publishers were concerned. An aspect of that was the procedure of enrichening ad requests for ad spaces on the side of Xandr, which benefits Xandr and Grindr likewise. While Grindr was able to control categories of data contained in bid requests as well as the recipients thereof through the console offered by Xandr, it was on Xandr’s side to provide the framework for exercising such control, for example by deciding what advertisers Grindr was able to interact with. In case Grindr did not make any selections within the console, the standard settings decided on by Xandr would apply and the bid request would be circulated to the recipients that Xandr included on its platform. By providing the framework and offering its service on the console with the standard selected by Xandr, Xandr had a tangible impact on the determination of the purposes and means of processing. Moreover, Xandr could instruct Grindr on the categories of data shared with it. When Xandr’s platform processed ad delivery and bid requests originating from Grindr, it acted partly as controller and partly as processor. Xandr maintained that it assumed the role of processor of Grindr, which is an assessment that is not supported by Grindr. The DPA considered that Xandr pursued its own objective of being a facilitator of exchanges between publishers and advertisers that involves data processing on its multi-sided platform. It was Xandr that defined the infrastructure and constraints for those exchanges. Xandr had an interest both when it came to the number of participants in that exchange system as well as when providing precise marketing and maximising value for advertisers and publishers were concerned. An aspect of that was the procedure of enrichening ad requests for ad spaces on the side of Xandr, which benefits Xandr and Grindr likewise. While Grindr was able to control categories of data contained in bid requests as well as the recipients thereof through the console offered by Xandr, it was on Xandr’s side to provide the framework for exercising such control, for example by deciding what advertisers Grindr was able to interact with. In case Grindr did not make any selections within the console, the standard settings decided on by Xandr would apply and the bid request would be circulated to the recipients that Xandr included on its platform. By providing the framework and offering its service on the console with the standard selected by Xandr, Xandr had a tangible impact on the determination of the purposes and means of processing. Moreover, Xandr could instruct Grindr on the categories of data shared with it. The DPA recurred to the broad understanding of the concept of “controller” according to CJEU case law and took into consideration the opaque practices in the AdTech industry where a large number of companies exchange personal data along complex value chains. It is unlikely in this ecosystem that one actor alone fully controls how the data is processed. According to the DPA, a failure to hold these companies accountable would result in diffusion or elimination of responsibility, also with regard to data subjects’ rights. This would run counter the objective of the GDPR to ensure a high level of data protection. The fact that neither Xandr nor Grindr accepted controllership would result in an evasion of responsibility to answer to data subjects’ rights. However, the notion of controller is a functional concept that is determined by factual circumstances and not by contractual agreements. Since both Xandr and Grindr pursued their respective interests and purposes when processing the personal data, they both exercised decisive influence on the decision on the means of processing. The processing could not have taken place without the contribution of both parties in deciding the purposes and means, making them joint controllers. The DPA recurred to the broad understanding of the concept of “controller” according to CJEU case law and took into consideration the opaque practices in the AdTech industry where a large number of companies exchange personal data along complex value chains. It is unlikely in this ecosystem that one actor alone fully controls how the data is processed. According to the DPA, a failure to hold these companies accountable would result in diffusion or elimination of responsibility, also with regard to data subjects’ rights. This would run counter the objective of the GDPR to ensure a high level of data protection. The fact that neither Xandr nor Grindr accepted controllership would result in an evasion of responsibility to answer to data subjects’ rights. However, the notion of controller is a functional concept that is determined by factual circumstances and not by contractual agreements. Since both Xandr and Grindr pursued their respective interests and purposes when processing the personal data, they both exercised decisive influence on the decision on the means of processing. The processing could not have taken place without the contribution of both parties in deciding the purposes and means, making them joint controllers. While joint controllers may distribute tasks and divide responsibility pursuant to [[Article 26 GDPR|Article 26(1) GDPR]], the accountability principle ([[Article 5 GDPR|Article 5(2) GDPR]]) as well as the obligations under [[Article 24 GDPR|Article 24 GDPR]] apply to both controllers. Compliance cannot be outsourced and both controllers are responsible and must demonstrate compliance with the GDPR, for example when it comes to determining a legal basis for the processing. While joint controllers may distribute tasks and divide responsibility pursuant to [[Article 26 GDPR|Article 26(1) GDPR]], the accountability principle ([[Article 5 GDPR|Article 5(2) GDPR]]) as well as the obligations under [[Article 24 GDPR]] apply to both controllers. Compliance cannot be outsourced and both controllers are responsible and must demonstrate compliance with the GDPR, for example when it comes to determining a legal basis for the processing. The DPA found that Xandr processed special categories of personal data pursuant to [[Article 9 GDPR|Article 9(1) GDPR]]. The information that a person is being registered on Grindr is to be considered information about someone’s sexual orientation. The DPA found that Xandr processed special categories of personal data pursuant to [[Article 9 GDPR|Article 9(1) GDPR]]. The information that a person is being registered on Grindr is to be considered information about someone’s sexual orientation. In the separate Grindr case before the DPA, the DPA found that the information that data subjects were Grindr users was not “manifestly made public” by the data subjects pursuant to [[Article 9 GDPR|Article 9(2)(e) GDPR]]. Xandr could also not rely on explicit consent pursuant to [[Article 9 GDPR|Article 9(2)(a) GDPR]]. It never obtained the consent directly from the data subjects itself. The consent that Grindr obtained from its users did not fulfil the requirements of [[Article 4 GDPR|Article 4(11) GDPR]] and [[Article 7 GDPR|Article 7 GDPR]]. Therefore, it was invalid. In the separate Grindr case before the DPA, the DPA found that the information that data subjects were Grindr users was not “manifestly made public” by the data subjects pursuant to [[Article 9 GDPR|Article 9(2)(e) GDPR]]. Xandr could also not rely on explicit consent pursuant to [[Article 9 GDPR|Article 9(2)(a) GDPR]]. It never obtained the consent directly from the data subjects itself. The consent that Grindr obtained from its users did not fulfil the requirements of [[Article 4 GDPR|Article 4(11) GDPR]] and [[Article 7 GDPR]]. Therefore, it was invalid. Both joint controllers must have a valid legal basis for the processing. The fact that Grindr was responsible for collecting the data subjects’ consent did not exempt Xandr from its accountability obligations under [[Article 5 GDPR|Article 5(2) GDPR]] and [[Article 24 GDPR|Article 24 GDPR]]. Despite the fact that it is possible to contractually oblige one joint controller to collect consent on behalf of the other, the other controller must ensure that the consent meets the requirements of [[Article 4 GDPR|Article 4(11) GDPR]] and [[Article 7 GDPR|Article 7 GDPR]]. Since the data at hand concerned special categories of data, Xandr was not able to discharge of its accountability obligations simply by contractual agreement. It did not take any additional measures to ensure that the consent given was lawful. Therefore, Xandr breached [[Article 9 GDPR|Article 9(1) GDPR]]. Both joint controllers must have a valid legal basis for the processing. The fact that Grindr was responsible for collecting the data subjects’ consent did not exempt Xandr from its accountability obligations under [[Article 5 GDPR|Article 5(2) GDPR]] and [[Article 24 GDPR]]. Despite the fact that it is possible to contractually oblige one joint controller to collect consent on behalf of the other, the other controller must ensure that the consent meets the requirements of [[Article 4 GDPR|Article 4(11) GDPR]] and [[Article 7 GDPR]]. Since the data at hand concerned special categories of data, Xandr was not able to discharge of its accountability obligations simply by contractual agreement. It did not take any additional measures to ensure that the consent given was lawful. Therefore, Xandr breached [[Article 9 GDPR|Article 9(1) GDPR]]. When it comes to the legal basis of [[Article 6 GDPR|Article 6(1) GDPR]] when processing personal data of Grindr users, since the consent that Grindr collected was invalid and Xandr did not provide sufficient information as to the legal basis, no legal basis was applicable. Therefore, the DPA found a violation of [[Article 6 GDPR|Article 6(1) GDPR]]. When it comes to the legal basis of [[Article 6 GDPR|Article 6(1) GDPR]] when processing personal data of Grindr users, since the consent that Grindr collected was invalid and Xandr did not provide sufficient information as to the legal basis, no legal basis was applicable. Therefore, the DPA found a violation of [[Article 6 GDPR|Article 6(1) GDPR]]. The DPA fined Xandr NOK 92,000,000 (€ 8,500,000). When it comes to the reasons for issuing the fine, the DPA argued that with [[Article 6 GDPR|Article 6(1) GDPR]] and [[Article 9 GDPR|Article 9 GDPR]], Xandr violated core data protection rights of individuals and basic requirements for processing personal data. The intransparency of the AdTech ecosystem was found an aggravating factor. Moreover, the data subjects did not initiate the processing and did not intend to share their personal data with Xandr and its 4,000 advertising partners for commercial purposes. The nature of the personal data affected, namely data on sexual orientation, was taken into account as well as the fact that Xandr financially benefitted from the unlawful processing. The DPA fined Xandr NOK 92,000,000 (€ 8,500,000). When it comes to the reasons for issuing the fine, the DPA argued that with [[Article 6 GDPR|Article 6(1) GDPR]] and [[Article 9 GDPR]], Xandr violated core data protection rights of individuals and basic requirements for processing personal data. The intransparency of the AdTech ecosystem was found an aggravating factor. Moreover, the data subjects did not initiate the processing and did not intend to share their personal data with Xandr and its 4,000 advertising partners for commercial purposes. The nature of the personal data affected, namely data on sexual orientation, was taken into account as well as the fact that Xandr financially benefitted from the unlawful processing. The fact that the procedure is, according to Xandr, an industry practice, cannot be considered a mitigating factor. This fact only reinforces the need for an administrative fine with a deterrent effect. The fact that the procedure is, according to Xandr, an industry practice, cannot be considered a mitigating factor. This fact only reinforces the need for an administrative fine with a deterrent effect. The DPA held that Xandr acted negligently because Xandr is a leading advertiser technology company and the processing of personal data on a large scale is a core part of its business. Therefore, it can be expected of Xandr to be acquainted and compliant with central data protection requirements. It was negligent of Xandr not to make any assessments regarding the lawfulness of the processing. The DPA held that Xandr acted negligently because Xandr is a leading advertiser technology company and the processing of personal data on a large scale is a core part of its business. Therefore, it can be expected of Xandr to be acquainted and compliant with central data protection requirements. It was negligent of Xandr not to make any assessments regarding the lawfulness of the processing. The amount of fine pursuant to [[Article 83 GDPR|Article 83(5)(a) GDPR]] was based on Xandr’s revenue, not on Microsoft’s because for the time period concerned, Xandr was not a part of Microsoft yet. The amount of fine pursuant to [[Article 83 GDPR|Article 83(5)(a) GDPR]] was based on Xandr’s revenue, not on Microsoft’s because for the time period concerned, Xandr was not a part of Microsoft yet. == Comment == == Comment == ''Share your comments here!'' ''This is the highest fine issued by the Norwegian DPA to date.'' == Further Resources == == Further Resources ==","Norway's Data Protection Authority (Datatilsynet) has fined Xandr NOK 92,000,000 (approximately €8.5 million) for processing personal data, including special categories, of Grindr users without valid consent during real-time bidding. The DPA found Xandr acted as a joint controller with Grindr, violating GDPR articles 6 and 9 due to the lack of a legal basis and valid consent for processing sensitive data related to users' sexual orientation. The fine, the largest issued by the Norwegian DPA to date, considered the opaque nature of the AdTech industry and Xandr's negligence.","Norway's DPA fines Xandr €8.5M for unlawful processing of Grindr user data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_20\u002F03541-37&diff=53382&oldid=53381","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fe8\u002FLogoNO.png","2026-10-13T11:22:22+00:00","2026-10-13T12:00:10.065065+00:00",8,[17,20,23,25],{"name":18,"type":19},"Xandr","vendor",{"name":21,"type":22},"Grindr","product",{"name":24,"type":19},"Microsoft",{"name":26,"type":19},"AppNexus","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":27,"icon":29,"name":30,"slug":31},null,"Policy","policy",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[24,18,26],{"controls":51,"vendors":126},[52,80,109],{"slug":53,"name":54,"problem":55,"products":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":74,"vendor_name":24,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":81,"name":82,"problem":83,"products":84},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":110,"name":111,"problem":112,"products":113},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[114,120],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":115,"product_name":116,"url":118,"description":119},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":122,"url":124,"description":125},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":142},"xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-real-time-biddin","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","Xandr, operating as a joint controller with Grindr, processed highly sensitive personal data — including information revealing users' sexual orientation — through real-time bidding (RTB) without a valid legal basis or explicit consent, violating GDPR Articles 6 and 9. The opaque and complex nature of the AdTech supply chain allowed sensitive data to flow to downstream partners without adequate transparency or user control. This case highlights that companies receiving personal data via programmatic advertising pipelines bear legal responsibility for ensuring consent is valid, not merely that data was passed to them by another party. The record-breaking NOK 92 million fine signals that regulators are increasingly scrutinizing the AdTech ecosystem as a systemic privacy risk, particularly where special category data is involved.",[132,133,134,135,136,137,138,139,140,141],"GDPR Article 6 (Lawfulness of Processing)","GDPR Article 9 (Processing of Special Categories of Personal Data)","GDPR Article 26 (Joint Controllers)","GDPR Article 35 (Data Protection Impact Assessment)","NIST Privacy Framework PR.PP-P4 (Data Processing Policies)","NIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)","CIS Control 3 (Data Protection)","CIS Control 15 (Service Provider Management)","ISO\u002FIEC 27701 Section 7.2.1 (Identify and document purpose)","IAB Transparency & Consent Framework (TCF) v2.0",{}]