[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftNXAbBRX7DIB2suO4AtgKNgT1Xoo1gKR62M7wppP5Ms":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"cc33de11-46ea-4912-9e2f-2269d34468ba","xandr-fined-85m-for-unlawful-data-processing-under-gdpr","b5a9de0e-30e0-403c-9615-458ef3b0154c","Xandr Fined €8.5M for Unlawful Data Processing Under GDPR","Microsoft's Xandr processed highly sensitive personal data — including information on sexual orientation sourced from the Grindr dating app — without a valid legal basis, violating GDPR's core principles around lawful processing and special category data. The root cause is a failure to establish and verify proper consent mechanisms before ingesting and profiling user data from third-party sources. This case illustrates how the adtech industry's opaque data-sharing ecosystems can expose organizations to massive regulatory penalties. It also highlights that receiving data from a third party does not absolve a company of its own GDPR obligations as a data controller or processor.","**Immediate actions:**\n- Audit all third-party data sources to verify that valid legal bases (e.g., explicit consent) exist before processing any personal or special category data.\n- Immediately suspend ingestion of sensitive category data (health, sexual orientation, religion, etc.) from any partner lacking documented, GDPR-compliant consent records.\n\n**Long-term improvements:**\n- Implement a Data Processing Agreement (DPA) review process for every data supplier, including periodic re-validation of consent mechanisms.\n- Establish a Data Protection by Design framework so that legal basis assessment is a mandatory gate before any new data pipeline is approved.\n- Appoint or empower a Data Protection Officer (DPO) to conduct regular internal audits of adtech and data-sharing practices.\n\n**Detection & monitoring measures:**\n- Deploy data classification tooling to automatically flag special category data entering processing pipelines for immediate legal review.\n- Maintain a comprehensive Record of Processing Activities (RoPA) and review it quarterly to detect unlawful or undocumented data flows.",[12,13,14,15,16,17,18,19,20],"GDPR Article 6 – Lawfulness of processing","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 28 – Processor obligations and Data Processing Agreements","GDPR Article 30 – Records of processing activities (RoPA)","GDPR Article 37-39 – Data Protection Officer requirements","NIST Privacy Framework PR.DS-P1 – Data processing ecosystem management","NIST SP 800-53 PT-2 – Authority to process personally identifiable information","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)",{},"published","2026-10-12T06:20:19.881952+00:00","2026-10-12T06:20:19.858+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fnoyb.eu\u002Fen\u002Fprivacy-win-norwegian-authority-fines-microsofts-xandr-eu-85-million","privacy-win-norwegian-authority-fines-microsoft-s-xandr-8-5-million-cedf6b","Privacy win: Norwegian Authority fines Microsoft’s Xandr € 8.5 Million",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[44,48],{"slug":45,"name":46,"problem":47},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":49,"name":50,"problem":51},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]