Grindr €6.5M fined for not collecting users’ valid consent for sharing data (opens in new tab)

neat, this analogy travels pretty far - user data is radioactive.

theres a background amount of radiation. its everywhere, even in higher amounts than youd expect like bananas and airplanes. no amount is safe, but the risks are neglibly small when exposure is minimized. concentrated amounts can be safe when exposure is controlled and managed with oversight programs in place. disasters can be managed with disaster programs, but its still possible that unforseen problems can cause big issues. unregulated handling can poison local populations. corporate influence on government can be a problrm.

what a comparison! there should be an award for this.

The data is power and can equate to money quite easily. This means that people are not going to handle data responsibly unless forced to do so.

Most companies have zero data controls and it ends up getting passed around everywhere and saved off by employees for their own personal use.

It's like waving money in front of people when you have no way to determine if it gets stolen or by whom.

I was raised in a family bookeeping business that handled all of the vital business data for hundreds of clients. Data protection and privacy (respect for clients) were always job #1.

This came to be my philosophy for all user data in any context. A philosophy that very few people share--and the rise of the web seems to have reversed any possibility of such a philosophy taking hold as user data became a form of currency.

I read it on Idlewords: https://idlewords.com/talks/haunted_by_data.htm. Pretty much all the talks there are fantastic!

Great minds think alike .

I’ve thought of this way in a broader sense.

If you have any data from user data to internal data from various LOB it should be : Data is the new uranium.

That's a very good analogy, I like it.

What does it mean for data to be no longer needed when one of your income streams is to sell user data?

As usual this fine is not enough as deterrent.

But, to use your analogy, why would companies treat user data like uranium when risk/reward is like that of oil?

Grinder surely made much more from data sales than the 6.something million Erous it was find. The paltry fines under GDPR do nothing to dissuade this behavio. That's been a recurring theme in previous HN discussions on this topic.

Right now, I would posit that these low penalties are for show. Governments don't want to lose the economic benefit of having these companies operate in the EU and the general public can be satisfied that their governments are on top of the issue.

You can collect as much data as you like, its what you do with it that counts.

These fines tend to go up with repeat performances. Sooner or later some company will be fined right out of business and then we'll see whether the remainder will catch on that playing games with regulators is a losing one.

Wait a second, it's not Grindr gathering and selling a list of homosexuals interested into sex.

It's the users themselves who actively register on Grindr to announce their services and picture on the platform.

If this activity is illegal in the country of the user, the best Grindr can do, is to prevent users from these countries from registering on the platform based on their national ID, but that's basically it.

Grindr has around 4 million daily users, and up to 30 million registered users in total. Even a fine of this size would be meaningless once divided between the users.

I'm all for that but only if you suspect that a company is abusing your data. Otherwise it amounts to a DDOS attack and that should be reserved for those that deserve it, not to place a burden on otherwise compliant companies.

But if you suspect that a company is abusing your data, selling it, enriching it with data that they shouldn't have: fire away.

The EU is merely leading the way here, you can expect all of the developed world to have similar data protection laws on the books sooner or later. And if you think that treating data in the proper way is hard then you probably shouldn't be in business at all. Operating in the EU is not a liability if you treat your users data in a respectful and responsible way. Common sense alone would answer your questions on what is and what isn't allowed in the vast majority of the cases.

That this doesn't align with the free-for-all that was the WWW for the first two and a half decades doesn't change that, morality isn't all that hard and each and every company that crosses those lines is very much aware of it. These are not accidental misinterpretations of the law by any stretch of the imagination, they are wilful abuse.

I feel that "just the way they like" is honestly a pretty low bar to clear and in general are common sense and respectful things that you should be doing with user data in the first place.

- Tell people up front what you will do with their data

- Let them opt out

- Track what services your own service uses (Ex: your website -> google analytics)

- If people want to know what data you have about them tell them

- If people want you to delete their data (and there is no legal obligation to keep it) delete their data

- Take reasonable steps to keep user data safe

In this case Grindr was passing (per the article): advertising ID, IP address, GPS, location, gender, age, device information and app name to a bunch of Ad Services with "no control".

So beyond just "handling data" Grindr was getting paid (ads) for sharing your data to companies that could then also turn around and do whatever they wanted with that data.

Sure, like any law in any place.

EU member states and representatives decided that not having certain business models is preferably. Them leaving the single market is a welcome result.

We can live without data hoarding companies, thanks.

GDPR enforcement is pretty gentle. For the first offence you will just get a warning. Grindr's fine is a warning that you should heed such warnings.

Yes, operating in the EU is a liability; operating anywhere that has laws is a liability. And the risks of operating somewhere that doesn't have laws is an even greater liability.

What aspect of GDPR is troublesome to you?

Because 'dont abuse your ownership of personal data' is pretty much what it boils down to.

Look at repeat offenses and how fast they go up. Level 1: don't do this, or we'll fine you. Level 2: here is your first fine, don't do this again or we'll fine you for real. Level 3: Ok, you clearly need something that will move the needle, here is fine you can't ignore. Level 4: you ignored it again, here is a fine that will put you out of business. So far we've only seen level 2 and one or two level 3 fines. Nobody has thought it wise to test the next levels up, it's a bit like the GPL in that respect.

That would be more than the full value of the company. Seems a little steep for the first fine.

Yes, but then you'd have to prove when this stuff was written because otherwise there are going to be a lot of engineers retro-actively in the field of fire.

It's the opposite, actually. I have no idea how you came to this conclusion.

Because society decided that it shouldn't be.

It's a political decision that charging money (or displaying not personalized ads) is preferably.

Interesting, because said practice from German news sites seems to have the blessing of the data privacy authorities. Sadly I can't find the source. It must have been one of the data privacy newsletters I receive.

So the Norge argument here would go further and I would like to see this challenged to the European Court as this would provide a final verdict.

Currently I feel that different countries see these things quite a bit different.

On the other hand it would only mean that you can't have a free version refinanced through advertising, but would need to find other ways of converting users into paying customers while still providing a striped down free app for generating reach.

Why can't organs be considered as a means of payment?

Not sarcasm - I think that while it's obviously a different scale, the reasons are similar and boil down to "we don't want that as a society" and "the environment this creates is not conductive to a free and informed rational decision". Many people don't understand the value of their data and the risk it poses, there is an information imbalance, there is a power imbalance (the company sets the terms, and you only get to take it or leave it).

The pre-GDPR situation also showed that the market doesn't really work, because everyone was collecting your data, people have limited energy and incentive to care because it doesn't cause immediately visible pain. It's similar to workplace safety - we don't allow employers to create easily avoidable dangerous situation in exchange for extra pay either, for similar reasons.

Most importantly, data grabbing is not necessary for advertising, it's just slightly more profitable and thus everyone does it, eventually pushing the "good" (privacy-friendly) players out of the market. If we want to change that, we need a de-facto ban (which a properly implemented GDPR would be, because so many people will click "No" if given a truly free choice that showing the popup won't be worth it).

> Why can't data be considered as a means of payment in this case?

One of the biggest reason would be that using data as payment has demonstrated to push out companies that don't want to collect data. Data as a mean of payment is less clear to the consumer about the costs, and there is no real good way to inform the public outside of an massive investment into the general education that focus on privacy, data laws, how data is gathered, why it is gathered, how it get traded and used, and what the outcomes are. The value added through data is also not taxed which creates an unfair advantage compared to other payment methods.

The 'data is payment' thing sounds terrible. What if it really goes south and this data is involved in some identity theft? Then the criminal justice system needs to get involved at enormous cost to tax payers. Therefore, there actually is an interest of the state that all this data should not be roaming around freely.

I think what's particularly scary about Grindr is just how much trouble even being on an app like that can get someone in. For example, a colleague of mine is from a country where being LGBT is not really tolerated, in the United States he uses Grindr.

I can imagine an oppressive government buying dating app data to blackmail their users. I noticed in the Tinder TOS thread people complaining about how impossible it is to meet folks in real life.

You can still have friends, friends have friends you can go out with. I'd say from a mental health POV you should be doing social things anyway.

What’s your alternative?

Clearly people use the app because the app answers a user need. So what’s your answer to the user need?

To get laid, now. It’s impressive in that regard.

How else are you supposed to get laid? I don't get this comment.

Not true, depending on the product. I'm sure the PreP ads I see on Grindr have no problem advertising on a gay hookup app.

But more to the point, Grindr got in trouble specifically for selling data to advertising networks presumably so they could also be targeted outside Grindr. Knowing someone's sex, sexual orientation, location, age and hobbies is great targeting data.

65,000,000 NOK is 6,492,207 EUR

The article brief had a 0 too few at first, but it has since been corrected.

At the time of writing, TFA mentioned a fine of 6,500,000NOK in the first paragraph rather than 65,000,000NOK - probably where the confusion comes from.

The HN headline is also "wrong" (or at least imprecise) - the fine amount is in NOK, so the euro figure is ~6.418 million depending on exchange rates.

My point though is that the maximum fines they can hand out, even for the third offense, are so low that they can't really give effective fines to some companies (unless they apply such a fine e.g. per user whose rights were violated, which doesn't seem to be what they're doing).

Grindr made a profit of $31M and a revenue of "well over $100M". The maximum fine is 20M EUR or 4% of revenue (whichever is higher). So assuming under 500M EUR in revenue, the maximum fine is lower than Grindr's 2019 profit. So if Grindr is the lucky one that serves as an example, I don't see how even the absolute worst case fine would put them out of business.

Although the max fine is probably higher than the 2019 profit from the EU, I could totally see that changing, and someone deciding that getting slapped with the maximum fine is cheaper than the loss of revenue from complying, especially if it is a business that is entirely in ads.

that is attacking a strawman that the comment did not make. It IS a paradox that people want information to be free but not if other people use it for advertising.