Rights International Spain (RIS) – No Violation (Spain, 2022)

Rights International Spain (RIS), a Spanish human rights NGO, filed a claim against LGBTQ Social Network App GRINDR (Grindr LLC) with the Spanish DPA (AEPD) on 9 March 2020. The claim was based on the [https://www.forbrukerradet.no/out-of-control/ “Out of Control” report] on targeted advertising practices published by the Norwegian Consumer Council (NCC), and the claimant selected Grindr as an example of potentially problematic data mining practices without data subject’s knowledge and consent. = The AEPD inquired if any other DPAs were carrying out procedures on this topic through the mutual assistance provision in Article 61 GDPR. The AEDP received affirmative replies from the Norwegian, Slovenian and French DPA. The Norwegian DPA informed the AEPD that its current investigation was in response to a claim received in January 2020. Hence, it was basing its investigation on Grindr’s active Consent Management Platform (CMP) at that time, and not on the updated CMP introduced in April 2020. The Norwegian DPA expressed that, according to their investigation, the consent obtained by Grindr for processing personal data used for marketing purposes seemed to be in breach of GDPR (see the summary of the Norwegian DPA's Grindr decision here). The Norwegian DPA also considered that Grindr was specifically oriented towards the LGBTQ community, and therefore, a legal basis under Article 9(2) GDPR for the processing of special categories of data was also required in this case. The Slovenian DPA informed the AEPD that it had also received a claim based on the same report, and was still awaiting a reply from Grindr’s representatives. The French DPA stated that it had received two complaints regarding this issue, but had not yet initiated any procedures at that moment. = In its response to the AEPD, Grindr highlighted that it had updated its CMP, which gives the data subject granular information regarding every non-essential processing element, allowing the user to actively consent to each individual one. This, in turn, is separated from the acceptance to their Terms and Conditions, as well as their Privacy Policy. Grindr also provided evidence that all these elements are set to non-consent by default, and users are not nudged in any way to opt in to the processing of any of this data. Additionally, Grindr noted that users can opt in or out to the processing of personal data for targeted advertisement in both the free and paid version of the application, and that the application will function in the same manner regardless, with the only difference that in the free version, the advertisement will not be personalised. = Grindr claimed that the only sensitive data processed are the data subject’s HIV status, the date of their latest HIV test, and the ethnicity category, and that this data is not shared with any third party, nor is it accessible to third party cookies or online tracking technologies. Additionally, Grindr insisted that despite promoting itself as "the world's largest social networking app for gay, bisexual, transgender and pansexual people” it is not possible to extract the user's sexual orientation from its use, since it does not strictly adhere to closed sexual orientations or specific gender identities. = Lastly, Grindr stated that it does not carry out automated decision-making to profile its users, and that it only uses automated security systems to block fraudulent or spam accounts (which are subject to human review if contested by the account holder), or to eliminate unacceptable images according to their Terms and Conditions. = The AEPD began by stating that although the claim was received in March 2020, their investigation is based on Grindr current CMP, which was updated in April 2020 (unlike the Norwegian DPA’s investigation previously mentioned in the Facts section, which is based on their previous CMP). The AEPD also stated that this was a generic investigation, in response to a complaint that was merely based on the NCC report, with no specific evidence with which to contrast if what Grindr states is actually true in practice. = The AEPD held that according to Grindr’s updated CMP, the processing of personal data was lawful based on the data subject’s consent under Article 6(1)(a) GDPR, which in turn meets the conditions for consent laid out in Article 7 GDPR. The AEPD highlighted that this consent was free, with an option to willfully accept properly individualised and differentiated elements. Additionally, the AEPD held that this processing was compliant with the principle of transparency established in Article 5(1)(a) GDPR and further developed in Article 12 GDPR, and that the data subject was duly provided with the information required by Article 13 GDPR. = The AEPD did not find that Grindr processed any special category of personal data in breach of Article 9 GDPR because it does not directly collect information regarding a person’s sexual orientation, and that the platform does not even have a field to specify this information on a user’s profile. The AEDP also noted that this data can only be shared voluntarily by users in their “About Me” text, or in private messages with other users, and that this information would not be accessible to third parties for advertising purposes. The AEPD also deferred that Grindr’s denial that use of the application would reveal any specific sexual orientation due to the fact that the platform is open to all sexual orientations and gender identities, and in Grindr’s own words, including heterosexuals "out of curiosity or to find a broader expression of self or to interact with other users". = Lastly, the AEDP held that Grindr does not seem to carry out automated decision-making that can affect data subject rights or process personal data to profile them, finding no apparent violation of Article 22 GDPR. = Based on the considerations, the AEDP held that its investigation had not found any processing of personal data by Grindr in breach of the GDPR. it therefore issued a decision to archive the procedure.