[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fi8kkGCKXRhto7rlsYSmGNoffKbcu18Toe6q0QsPafAs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"0856caf6-fc77-45c9-bba1-bac458e30752","norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","605d5d18-a556-4c7d-b4f8-bb860e4f89bc","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","Xandr Inc. was fined by Norway's Datatilsynet for processing personal data without a valid legal basis or proper consent, violating core GDPR principles. The case originated from data shared by the Grindr app, which disclosed sensitive user information to advertising partners without meeting GDPR's stringent consent requirements. This highlights how ad-tech ecosystems often inherit liability when downstream data processors fail to independently verify the lawfulness of data flows. The case matters because it demonstrates that third-party data recipients — not just the original collectors — bear accountability under GDPR. Organizations handling personal data for advertising purposes must not assume upstream consent is valid and sufficient.","**Immediate actions:**\n- Audit all incoming data streams from third-party partners to verify documented legal bases (consent, legitimate interest, etc.) are valid and GDPR-compliant.\n- Suspend processing of any personal data where a lawful basis cannot be confirmed until a legal review is completed.\n\n**Long-term improvements:**\n- Implement a formal Data Processing Agreement (DPA) review program requiring regular re-validation of consent chains with all upstream data suppliers.\n- Establish a Data Protection Officer (DPO)-led review process for any new advertising or data-sharing partnerships before onboarding.\n- Maintain a continuously updated Record of Processing Activities (RoPA) to map every data flow and its associated legal basis.\n\n**Detection & Governance measures:**\n- Deploy automated consent-verification checks within your data ingestion pipelines to flag records lacking valid consent metadata.\n- Conduct annual third-party data compliance audits, including review of partners' privacy notices and consent mechanisms.\n- Set up a regulatory monitoring process to track enforcement actions in relevant jurisdictions and assess applicability to your own data practices.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 6 – Lawfulness of processing","GDPR Article 7 – Conditions for consent","GDPR Article 5(1)(a) – Principle of lawfulness, fairness, and transparency","GDPR Article 28 – Processor obligations and Data Processing Agreements","GDPR Article 30 – Records of processing activities","NIST Privacy Framework PR.AT-P1 – Awareness and Training","NIST SP 800-53 PT-1 – Policy and Procedures for Personally Identifiable Information","NIST SP 800-53 AC-20 – Use of External Information Systems","CIS Control 3 – Data Protection","CIS Control 14 – Security Awareness and Skills Training","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)","ITIL – Supplier Management (third-party risk governance)",{},"published","2026-10-14T14:21:53.454936+00:00","2026-10-14T14:21:53.44+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_20\u002F03541-37&diff=53407&oldid=53391","datatilsynet-norway-20-03541-37-b26a85","Datatilsynet (Norway) - 20\u002F03541-37",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]