In the complex ecosystem of online advertising, each actor is required to ensure the lawfulness of their own data processing and cannot shift responsibility onto other links in the chain, even in the presence of contractual relationships.

Facts and context

The Norwegian Data Protection Authority (Datatilsynet) issued a sanction decision against the advertising technology company Xandr (now a Microsoft subsidiary), including the imposition of a fine of 92 million Norwegian kroner (approximately 7.8 million euros) for breaches related to the processing and sharing of sensitive personal data of users of the Grindr dating app. The decision became final, as Xandr did not appeal.

The case began with a complaint filed in 2020 by the Norwegian Consumer Council (Forbrukerrådet) concerning the sharing of user data in the context of real-time advertising auctions.

Reasons for the decision

• Obligation to have a legal basis for processing special categories of data (Article 9 of the GDPR): The authority concluded that Xandr processed data revealing sexual orientation, which constitutes a special category of data requiring explicit consent. Indeed, merely being a user of Grindr, an app intended for gay and bisexual men as well as transgender and queer individuals, is information indicating sexual orientation. Xandr, acting as an intermediary in real-time auctions, transmitted this information to thousands of actors in the advertising ecosystem without verifying the existence of valid consent. The authority rejected Xandr's argument that the responsibility to obtain consent lay solely with Grindr, emphasizing that each controller must independently ensure the lawfulness of its own processing operations. The authority furthermore qualified Xandr as a joint controller with Grindr, reinforcing its obligation to ensure compliance.

Authority's decision

Consequently, the authority imposed a fine of 92 million Norwegian kroner (approximately 7.8 million euros) on Xandr. To determine this amount, the authority considered the seriousness of the breaches, their duration (from July 2018 to April 2020), the direct financial gain for the company, and its status as a major sector player. The fine calculation was based on Xandr's turnover before its acquisition by Microsoft, as the infringement period preceded this operation.

Lessons learned

This decision reminds that:

• Compliance responsibility under the GDPR cannot be delegated; each actor in a processing chain, including a technical intermediary, must ensure and be able to demonstrate that it has a valid legal basis for its own processing operations.
• Relying on assurances from a business partner (such as an app publisher) regarding obtaining consent does not relieve a controller of its own verification obligations, especially when sensitive data are processed.
• The mere use of an app clearly intended for a specific community can constitute an indication of the user's sexual orientation, thus qualifying this information as a special category of data within the meaning of Article 9 of the GDPR.