[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgSkesLd1CillNaNIKj7M9ihTqSzmizQbBT5LrgyfD18":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"734e62d6-9822-489c-9230-f153b57fa2ac","xandr-fined-85m-for-processing-grindr-users-sensitive-data-without-valid-consent-in-re-1791908476956","eda9ad2b-f0f8-483f-861c-672f8cbff09b","Xandr Fined €8.5M for Processing Grindr Users' Sensitive Data Without Valid Consent in Real-Time Bidding","Xandr processed highly sensitive personal data — including sexual orientation inferred from Grindr usage — through real-time bidding (RTB) pipelines without a lawful basis under GDPR. Norway's Datatilsynet ruled that joint controllership responsibilities cannot be delegated away, meaning both the data source (Grindr) and the downstream processor (Xandr) share full accountability for compliance failures. This case highlights how ad-tech supply chains routinely pass sensitive personal data across dozens of third parties, each of whom inherits significant legal obligations. The €8.5 million fine underscores that ignorance of the sensitivity of received data is not a valid legal defense, especially when the data originates from platforms with obvious sensitive-category implications.","**Immediate actions:**\n- Audit all third-party data feeds to identify whether sensitive or special-category personal data (Article 9 GDPR) is being received and processed.\n- Suspend or reject RTB bid streams that cannot provide documented proof of valid, granular user consent before further processing.\n\n**Governance & Compliance measures:**\n- Establish formal Joint Controller Agreements (Article 26 GDPR) with any partner who co-determines the purposes and means of data processing.\n- Implement a Data Protection Impact Assessment (DPIA) for all real-time bidding and programmatic advertising workflows involving personal data.\n- Appoint a Data Protection Officer (DPO) with specific mandate to review ad-tech integrations and consent chain validity.\n\n**Long-term improvements:**\n- Build a comprehensive third-party data inventory mapping every upstream data supplier to the legal basis and sensitivity classification of data received.\n- Enforce contractual data minimisation clauses with supply-chain partners to prevent receipt of special-category data unless explicitly required and lawfully justified.\n- Conduct regular compliance training for product, engineering, and partnerships teams on GDPR joint controllership and special-category data obligations.",[12,13,14,15,16,17,18,19,20,21,22,23],"GDPR Article 5 – Principles of data processing (lawfulness, purpose limitation)","GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 26 – Joint controllers","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","GDPR Article 83 – General conditions for imposing fines","NIST Privacy Framework PR.DS-P1 – Data processing policies","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information","CIS Control 3 – Data Protection (Data Inventory and Classification)","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)","IAB TCF (Transparency & Consent Framework) – Consent signal validation in RTB",{},"published","2026-10-13T16:21:16.975888+00:00","2026-10-13T16:21:16.914+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_20\u002F03541-37&diff=53391&oldid=53387","datatilsynet-norway-20-03541-37-a3294f","Datatilsynet (Norway) - 20\u002F03541-37",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":40,"name":41,"slug":42,"description":43,"color":44},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":46,"name":47,"slug":48,"description":49,"color":50},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[53,57],{"slug":54,"name":55,"problem":56},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":58,"name":59,"problem":60},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]