Microsoft Company Fined Nok 92 Million For Unlawfully Sharing Personal Data

The advertising service Xandr processed and shared sensitive personal data in breach of data protection law.

The Norwegian Data Protection Authority has now issued an administrative fine of 92 million Norwegian kroner, equivalent to €8.6 million, which is the highest fine it has issued to date.

– We issued such a high fine in this case because the breaches we identified were very serious. Thousands of users in Norway have been subjected to unlawful sharing of their sensitive data, says Line Coll, Director General of the Norwegian Data Protection Authority.

Xandr acted as an intermediary that relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies. Xandr defended itself by saying that they thought Grindr had collected users’ consent, but the Norwegian Data Protection Authority does not accept that actors can simply blame one another.

– Our key message is that responsibility for data protection cannot be passed on to others. Each and every company must itself ensure, and be able to document, that they process personal data lawfully. This case also demonstrates how opaque the advertising ecosystem is for individuals. When companies do not take responsibility and blame each other, the rights of users become, in practice, worthless, says Coll.

Sensitive data was auctioned in real time

The Norwegian Data Protection Authority has now concluded that the company did not have a legal basis to process the personal data of Grindr users in Norway. Grindr is a location-based dating app aimed at gay, bi, trans and queer people.

The essence of the infringement was Xandrs participation in so-called real-time bidding, where they acted both on the buyer and seller side. When a person opened Grindr, their personal data was in many cases relayed through Xandr to potentially thousands of actors in the advertising ecosystem. Advertisers could thereby bid against each other to present targeted adverts, completely hidden from the individual user.

What is real-time bidding?

Real-time bidding is a technology in the advertising business where websites and apps with advertising space personal data of visitors and users with advertising platforms.

In this way, different advertisers can bid against each other to show their advert to the person visiting the service. This makes personalised adverts possible. The transactions are automatic and happen in a fraction of a second.

– This shows just how vulnerable our privacy is. Once personal data is out there, it is difficult to know where it ends up or how it gets used. We are talking here information of a private nature over which someone has lost control. That information can also be combined with other data points and create an immensely detailed picture of a person’s life. says Coll.

Being a user of Grindr is itself information that indicates sexual orientation. Such information enjoys special protection, which the Borgarting Court of Appeal also ruled when Grindr received a fine of 65 million kroner for equivalent breaches in 2021 .

The Norwegian Data Protection Authority’s conclusion was that explicit consent was required to process this personal data, but that Xandr had not done anything to ensure that they had valid consent.

– Instead, the company assumed that this was Grindr’s responsibility. Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing. says Coll.

The Norwegian Data Protection Authority found that Xandr was a joint controller with Grindr.

The Norwegian Data Protection Authority’s highest ever fine

An administrative fine must be effective, proportionate to the infringement and dissuasive, both for Xandr and other actors. Xandr is a large and leading actor in the advertising technology sector, where the very core of the business model is, in fact, the processing personal data. The fact that the company derived a direct financial benefit from the unlawful sharing of personal data was a major factor.

The infringements took place over almost two years, from July 2018 to April 2020. The fact that the unlawful practice lasted for such a long time was considered to be an aggravating factor when assessing the amount of the fine.

The amount was calculated based on Xandr’s own total annual turnover. Microsoft’s turnover was not used, as Xandr was not a part of Microsoft for the time period in question.

Xandr has three weeks from when they received the decision to appeal it.

Phone number: (+47) 22 39 69 64

E-mail: [email protected]