Microsoft-Owned Xandr Hit With Record $9.6 Million Norwegian Privacy Fine

Key Takeaways

• Record Privacy Fine: Norway's Data Protection Authority fined Microsoft-owned Xandr approximately $9.6 million (NOK 92 million), its largest administrative penalty to date.
• Unlawful Sharing of Sensitive Data: Xandr processed and shared information revealing the sexual orientation of thousands of Grindr users in Norway through real-time advertising auctions.
• Failure to Establish Valid Consent: Regulators found that Xandr relied on Grindr to obtain user consent without verifying its validity, despite being a joint controller of the personal data.
• Nearly Two Years of Violations: The unlawful processing occurred between July 2018 and April 2020, with the duration and financial benefit contributing to the severity of the penalty.
• Microsoft Revenue Excluded: The fine was calculated using Xandr's own annual turnover because the violations occurred before the company became part of Microsoft.

Deep Dive

Norway's data protection authority has fined Microsoft-owned advertising technology company Xandr approximately $9.6 million (NOK 92 million) for unlawfully processing and sharing sensitive personal information belonging to users of the dating app Grindr.

The penalty, the largest ever imposed by the Norwegian Data Protection Authority (Datatilsynet), follows an investigation into an advertising system that allowed information about thousands of Norwegian Grindr users, including data revealing sexual orientation, to be transmitted to potentially thousands of companies.

The violations occurred between July 2018 and April 2020, before Xandr became part of Microsoft. Datatilsynet found that Xandr had no valid legal basis for processing the information. The company maintained that it believed Grindr had obtained the necessary consent from users, but the authority concluded that Xandr had failed to verify whether that consent was valid.

"We issued such a high fine in this case because the breaches we identified were very serious," said Line Coll, director general of Datatilsynet. "Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data."

The investigation began in 2020 following a complaint by the Norwegian Consumer Council against Xandr, then known as AppNexus.

How the Data Was Shared

The violations arose from Xandr's participation in real-time bidding, an automated advertising process in which companies compete to display advertisements to individual users.

When someone opened Grindr, their personal information could be transmitted through Xandr to other companies participating in the advertising market. Xandr operated on both the buying and selling sides of these transactions.

The exchanges took place in fractions of a second, largely without the knowledge of the individuals whose information was being shared. Datatilsynet determined that the processing involved special categories of personal data protected under the General Data Protection Regulation (GDPR). The authority noted that information identifying someone as a Grindr user can itself reveal sexual orientation.

Such information requires additional legal protection. In this case, the authority concluded that explicit consent was necessary, but Xandr had not established that valid consent existed.

The findings also raised concerns about the extent to which individuals can control information once it enters the advertising market. Coll warned that personal information shared through these systems can be difficult to trace and may subsequently be combined with other data to build detailed profiles of individuals.

Xandr Held Responsible for Its Own Processing

A central question in the investigation was whether Xandr could rely on Grindr to obtain the necessary consent. Xandr argued that it believed Grindr had fulfilled that responsibility. Datatilsynet rejected the explanation, finding that Xandr was a joint controller of the personal information and had its own obligations under the GDPR.

The authority said Xandr had failed to verify the validity of Grindr's consent arrangements or otherwise establish a lawful basis for processing the information.

"Our key message is that responsibility for data protection cannot be passed on to others," Coll said.

The decision follows an earlier enforcement action against Grindr. In 2021, Datatilsynet fined the dating app approximately $6.8 million (NOK 65 million) for related violations. Norway's Borgarting Court of Appeal subsequently upheld that penalty, including the authority's finding concerning the sensitive nature of information revealing Grindr usage.

The Xandr case examined the responsibilities of an advertising intermediary involved in distributing that information.

Duration and Financial Benefit Influenced Penalty

In determining the fine, Datatilsynet considered the seriousness of the violations, the nearly two-year period during which they occurred and the financial benefit Xandr obtained from the unlawful processing.

The authority described Xandr as a major participant in the advertising technology industry, where processing personal information is central to commercial operations.

It regarded the duration of the violations as an aggravating factor and concluded that the penalty needed to reflect both the seriousness of the conduct and the requirement under the GDPR that administrative fines be effective, proportionate and dissuasive.

The fine was calculated using Xandr's own total annual turnover rather than Microsoft's revenue. Datatilsynet explained that Microsoft did not own Xandr during the period covered by the investigation.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.