News from IT on October 13th: The Norwegian Data Protection Authority has now imposed an administrative fine of 92 million Norwegian kroner on Xandr, which is equivalent to 8.6 million euros (Note from IT: The current exchange rate is approximately 64.513 million RMB). This is the highest fine ever imposed by the authority to date.

Lina Koll, the head of Norway's Data Protection Authority ( Line Coll ), stated: "The reason for the heavy fine in this case is that the violations we identified were extremely serious. Sensitive data of thousands of Norwegian users was illegally shared."

Xandr acts as an intermediary, forwarding the personal data of Norwegian Grindr users (including information that reflects their sexual orientation) to thousands of other companies. The defense argument of Xandr is that they believe Grindr has obtained user authorization, but the Norwegian Data Protection Authority does not acknowledge that companies can shift responsibility back and forth among each other.

Kohl said, "The core message we want to convey is that the responsibility for data protection cannot be shifted to others. Every company must ensure for itself that its handling of personal data is legal and must be able to provide evidence to prove it. This case also highlights the extremely low level of transparency in the advertising ecosystem for individuals. Once companies are unwilling to take responsibility and shift blame onto each other, users' rights effectively become meaningless."

The case began in 2020 when the Norwegian Consumer Council complained to the Norwegian Data Protection Authority against the advertising technology company Xandr (then known as AppNexus, and now a subsidiary of Microsoft).

The Norwegian Data Protection Authority has now determined that the company has no legal basis for processing personal data of Norwegian Grindr users. Grindr is a geolocation-based dating app targeted at gay, bisexual, transgender, and queer communities.

The core of the infringement is that Xandr participates in the so-called real-time bidding process, playing both the buyer and seller roles simultaneously. Whenever users open Grindr, their personal data is mostly transferred through Xandr to thousands of participants in the advertising ecosystem. Advertisers use this process to bid for targeted advertisements, and the entire process is completely concealed from the users.

What is real-time bidding?

Real-time bidding is a technology in the advertising industry, where websites and applications with ad spaces share visitors' and users' personal data with advertising platforms.

Different advertisers compete for the opportunity to display ads to that user through bidding, and personalized advertising is thus achieved. Such transactions are completed automatically and can end in a mere instant.

Cole said, "This incident fully demonstrates how vulnerable our privacy is. Once personal data is leaked, it becomes very difficult to track its whereabouts and how it is used. For this type of private information we are discussing, users have lost control over it. This information can also be combined with other data to create an extremely detailed profile of a person's personal life."

The use of Grindr itself constitutes information that can indicate sexual orientation, and such information is under special protection. In 2021, when Grindr was fined 65 million kronor (approximately 65.341 million RMB at the current exchange rate) for a similar violation, the Borgarting Court of Appeal also made a relevant ruling.

The Norwegian Data Protection Authority has determined that processing such personal data requires explicit authorization, but Xandr has not taken any measures to confirm that it has obtained valid user consent.

Cole stated, "On the contrary, the company holds that this incident is the responsibility of Grindr. Xandr did not verify whether the authorization obtained by Grindr was valid, nor did they take any measures to ensure that their data processing activities were based on legal grounds."

The Norwegian Data Protection Authority has determined that Xandr and Grindr are joint data controllers.

Administrative penalties must have a disciplinary effect, be commensurate with the illegal acts, and serve as a deterrent to Xandr as well as other market entities. Xandr is a leading large enterprise in the advertising technology industry, and the core of its business model is the processing of personal data. The company directly derives economic benefits from the illegal sharing of personal data, which is an important factor in determining the amount of the fine.

The illegal activities lasted for nearly two years, from July 2018 to April 2020. Such prolonged violations were considered aggravating factors in the calculation of fines.

The fine amount is calculated based on the annual total turnover of Xandr itself, and Microsoft's revenue data was not used, as Xandr was not yet under Microsoft's umbrella during the period in question.

After receiving the penalty decision, Xandr has three weeks to file an appeal.