New EU ruling could possibly change standards on sharing sensitive data, specifically involving data indirectly revealing one’s sexual orientation
Before this ruling, other data protection authorities such as the Spanish Data Protection Authority had divergent views stating that it did not find Grindr to have processed any special category of personal data
.png)
On 1st August 2022, in a Lithuanian case, the Court of Justice of the EU issued a ruling on the interpretation of special categories of personal data under the GDPR. The case involved the publication of the name of a spouse who happened to be a user of the grinder application. The use of the application implicitly suggests one’s sexual orientation.
The complainant filed a claim against Grindr alleging its unlawful data sharing with 3rd parties users profile data, GPS location and the fact that they use Grindr. In this case, the Norwegian data protection Authority concluded that the processing of personal data out of which an inference of one’s sexual orientation can be drawn constitutes processing of special categories of personal data and filed the application 6.5 million for not complying with consent rules.
Before this ruling, other data protection authorities such as the Spanish Data Protection Authority had divergent views stating that it did not find Grindr to have processed any special category of personal data. The ruling by CJEU clears the dissonance and assumption that “inferred data is not data and expressly targets the advertising industry. This assertion is expected to change standards in the digital ad ecosystem towards more privacy centric efforts.
