71–80 of 297 posts
Great news! They have been preying on a very vulnerable community.
This whole case seems to revolve around whether the 'Legitimate Interest' legal basis is valid or not. It was only a matter of time before it was legally challenged.
It also caught my eye that their TOS didn't allow users a choice in data sharing, it was either agree or don't use the app. That might have some wide ramifications, I've encountered many web sites that won't let you past the sharing opt-in until you click agree - i.e. it is impossible to disagree. It is a completely foreign concept for US companies.
Wikipedia says Grindr is based in California, US. I wonder if they will pay the fine or refuse. If they have no assets in Norway I imagine it may be hard to collect from them.
> Grindr is now relying on a new consent system and alleged "legitimate interest" to use data without user consent. This is in conflict with the decision of the Norwegian DPA, as it explicitly held that "any extensive disclosure ... for marketing purposes should be based on the data subject’s consent". This "legitimate interest" shenanigans is coming up more and more often, where you have a modal with lots of options…
> Grindr is now relying on a new consent system and alleged "legitimate interest" to use data without user consent. This is in conflict with the decision of the Norwegian DPA, as it explicitly held that "any extensive disclosure ... for marketing purposes should be based on the data subject’s consent". This "legitimate interest" shenanigans is coming up more and more often, where you have a modal with lots of options…
I do get that this type of regulation is very disruptive to many companies, but if they cannot survive with informed consent, then perhaps they should not have been so successful without it in the first place.
I'm surprised about: >Consent must also be freely given. The DPA highlighted that users should have a real choice not to consent without any negative consequences. Grindr made use of the app conditional on consenting to data sharing or to paying a subscription fee. I thought that this was allowed. Kind of puts companies depending on advertising in really bad position. One would expect that having choice of paying or…
I was a little surprised by this: "The DPA highlighted that users should have a real choice not to consent without any negative consequences." Does this mean that it is unacceptable to run a service which requires consent to share data? That seems overly restrictive - where does that leave services in which sharing data is the whole point of the service? The article goes on to say: "Grindr made use of the app conditi…
> where does that leave services in which sharing data is the whole point of the service? When you actively share data with others, consent to process the data for this implicit. So as I understand it, a dating app would not need your explicit consent to share a profile photo with others on the platform since that is the whole point of the app. But if the service decides to provide your personal data to advertisers,…
They are sending all of their user's data with an "opt out" flag and leaving it to the ad companies to honor it? Slow clap? It also caught my eye that their TOS didn't allow users a choice in data sharing, it was either agree or don't use the app. That might have some wide ramifications, I've encountered many web sites that won't let you past the sharing opt-in until you click agree - i.e. it is impossible to disagre…
I thought, but have never verified, that fines given as GDPR enforcement can be collected throughout the EU/EEA. If this is true, and if European courts uphold the fines when Grindr undoubtedly challenge them, then it's my understanding that the Norwegian DPA can have Grindr assets elsewhere in the EEA seized.
Does anyone know for sure?
GDPR contains special protections for LGBT people, but Grindr shared their users private information with third parties anyway, since they argued that Grindr users might be straight... Pretty shocking and absurd.
I was a little surprised by this: "The DPA highlighted that users should have a real choice not to consent without any negative consequences." Does this mean that it is unacceptable to run a service which requires consent to share data? That seems overly restrictive - where does that leave services in which sharing data is the whole point of the service? The article goes on to say: "Grindr made use of the app conditi…
> Does this mean that it is unacceptable to run a service which requires consent to share data? That seems overly restrictive - where does that leave services in which sharing data is the whole point of the service? GDPR literally says that you're allowed to run a service that requires data and you don't even have to ask for consent for that type of data. What you're not allowed is to collect data that's NOT critical…
Earlier quoted context omitted.
EEA has all the laws and requirements of the EU but without representiation. So they have to follow the laws and rules but don't have a voice in the rules. I have no idea what the benefit of the EEA is for it's members other than political that they can say they're not in the EU but there must be some, maybe they don't need to pay in like EU members do?
There are also passport checks when you fly to Norway from other EU countries. For flights between other EU countries you generally just show the QR code on your phone. At least that was my experience, but it's been a few years since I last flew. (Except flights to UK before Brexit, I think they always required passport checks)
Except countries in the Nordic Passport Union: https://en.wikipedia.org/wiki/Nordic_Passport_Union You need zero documents to travel between these (well, you need a ticket if you fly or travel by train or a bus).