Discussing private data alongside Grindr’s application label or app ID is the same as sharing data regarding your sexual orientation putting Grindr within specifications of Article 9
Under post 9 for the GDPR, in order to lawfully processes unique kinds of data, the controller must fulfil one of several exemptions of Article 9(2) in addition to creating appropriate permission pursuant to post 6(1). Of significance in this instance had been the exemptions of specific permission and of facts topics manifestly making the private data public.
Datatilsynet further concluded that information that a data subject is actually a Grindr individual was information a€?concerninga€? the info matter’s sexual orientation in the framework of post 9
With its investigation Datatilsynet discovered that OpenX, Grindr’s processor, removed the information of Grindr’s application through the online store and connected keyword phrases instance a€?gaya€?, a€?bia€?, a€?transa€? and a€?queera€? to post phone calls. These keywords and phrases were not created or provided by Grindr to OpenX, these people were generated of the OpenX computer software developing equipment (SDK). While Datatilsynet concurred that keywords and phrases discussed on various intimate orientations tend to be common and outlined the software, maybe not a particular facts topic, Datatilsynet concluded that the posting of private facts alongside the software label, application ID and/or keywords explaining the application qualifies as revealing facts concerning an individual’s sexual direction. The Datatilsynet reasoned that Grindr just isn’t supposed to be utilized by cis people looking to communicate with cis people and the other way around; Grindr explicitly targets information topics belonging to a sexual fraction through their advertising and marketing; public notion is are a Grindr user indicates that the data matter belongs to a sexual minority; and this the disclosure of information on a data subject matter alongside that the info subject are a user of Grindr, or even the key words, over at this website firmly show into recipient your facts topic belongs to a sexual minority.
Grindr argued it couldn’t communicate data with regards to a user’s intimate direction hence the truth that a data topic is a Grindr individual will not meet the requirements as data regarding an individual’s sexual direction
Grindr’s debate that post tech enterprises have actually designed blinding solutions to obfuscate which app the ad name comes from, hence individuals in the advertising tech ecosystem probably only see a a€?blindeda€? application ID and not the corresponding software name to ensure that downstream bidders were blind on real label regarding the software where in fact the advertising is usually to be supported is rejected by Datatilsynet. Controllers cannot rely on the action of advertising partners or any other players during the post technology ecosystem to prevent their sharing of data. Irrespective, Datatilsynet was given a Mnemonic technical document from the NCC which showed that the Grindr application title was actually shared to Twitter’s MoPub, exactly who further discussed this inside of their network, together with software term has also been shared from Grindr to multi various other advertising lovers. Furthermore, even when the software label or application ID got really dazzled, the person could still receive key words relating to the Grindr software, as evidenced by OpenX appending keyword phrases in post calls.
Grindr additionally debated that when you are a person of Grindr, the data matter features manifestly produced data with regards to their sexual direction market. Datatilsynet disagreed finding that you will find a definite distinction between creating suggestions open to a community of colleagues on the Grindr platform and deciding to make the records accessible to individuals.
As Grindr was actually located to possess compiled incorrect consents under Article 6(1), the sharing of any special types of data ended up being unlawful regardless of post 9.