[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZNVA_ADYkY3p5QacXB4NPHl22NOyNrfLpzDLSYug7xA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"9381c615-17fb-46af-882d-05c5b2fb761c","xandr-fined-85m-for-unlawful-processing-of-sensitive-grindr-user-data-in-real-time-bidding","8a26ce98-21bf-4d28-b6c7-ca19e28ffab6","Xandr Fined €8.5M for Unlawful Processing of Sensitive Grindr User Data in Real-Time Bidding","Xandr, operating as a joint controller within the opaque AdTech real-time bidding ecosystem, processed sensitive personal data — including sexual orientation — of Grindr users without a valid legal basis, violating GDPR Articles 6(1) and 9. The root failure was a systemic disregard for lawful consent mechanisms, compounded by the complexity of a supply chain involving over 4,000 advertising partners who collectively amplified the exposure of sensitive data. This case underscores that 'industry standard practice' is not a legal defence under GDPR, particularly when processing special category data. The financial gain derived from the unlawful processing was treated as an aggravating factor, signalling that regulators will scrutinise the economic incentives behind data misuse. Organisations must understand that participating in programmatic advertising ecosystems creates joint controllership obligations that cannot be delegated away.","**Immediate actions:**\n- Conduct a full audit of all data flows within your AdTech or third-party data-sharing ecosystem to identify processing of special category data.\n- Suspend any real-time bidding or data syndication activities that rely on sensitive personal data until valid consent mechanisms are confirmed to be in place.\n- Review and update all Data Processing Agreements (DPAs) with advertising partners to explicitly address joint controllership responsibilities.\n\n**Long-term improvements:**\n- Implement a Consent Management Platform (CMP) that captures granular, informed, and freely given consent before any sensitive data enters programmatic advertising pipelines.\n- Establish a vendor risk management programme that vets all AdTech partners for GDPR compliance before onboarding and periodically thereafter.\n- Adopt a data minimisation strategy that prevents sensitive attributes (e.g., sexual orientation, health data) from being shared with downstream advertising partners by default.\n\n**Detection & Monitoring measures:**\n- Deploy continuous data flow monitoring tools to detect unauthorised transmission of special category data to third-party platforms.\n- Set up automated alerts for any new data-sharing integrations that may inadvertently expose sensitive personal data categories.\n- Conduct annual Privacy Impact Assessments (PIAs\u002FDPIAs) specifically covering programmatic advertising and data brokerage activities.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 6(1) — Lawfulness of processing","GDPR Article 9 — Processing of special categories of personal data","GDPR Article 26 — Joint controllers","GDPR Article 35 — Data Protection Impact Assessment (DPIA)","NIST Privacy Framework PR.CO-P3 — Data processing consent","NIST SP 800-53 PT-2 — Authority to Process Personally Identifiable Information","NIST SP 800-53 PT-5 — Privacy Notice","CIS Control 3 — Data Protection","CIS Control 15 — Service Provider Management","ISO\u002FIEC 27701 — Privacy Information Management (PIMS)","ITIL Service Design — Third-party and supplier management",{},"published","2026-10-13T14:20:35.904812+00:00","2026-10-13T14:20:35.881+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Datatilsynet_(Norway)_-_20\u002F03541-37&diff=53387&oldid=53382","datatilsynet-norway-20-03541-37-2b19d2","Datatilsynet (Norway) - 20\u002F03541-37",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[52,56,60],{"slug":53,"name":54,"problem":55},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",{"slug":57,"name":58,"problem":59},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":61,"name":62,"problem":63},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]