A company operating an online second-hand clothing trading and exchange platform is fined under the General Data Protection Regulation

On 2 July 2024, Lithuanian data protection supervisory authority – State Data Protection Inspectorate (SDPI), decided to impose an administrative fine of EUR 2 385 276 on Vinted, UAB (the company), the operator of the online second-hand clothing trading and exchange platform “Vinted”. The fine was imposed by the SDPI following the examination of the applicants’ complaints forwarded by the French and Polish supervisory authorities and finding the infringements of Article 5(1)(a) of the General Data Protection Regulation (GDPR) (the principles of lawfulness, fairness and transparency), Article 5(2) of the GDPR (the principle of accountability), and Articles 12(1) and 12(4) of the GDPR (transparent information, communication and conditions for the exercise of the data subject’s rights).

The SDPI carried out an investigation following the applicants’ complaints forwarded by the French and Polish supervisory authorities in 2021 and 2022, respectively, alleging that the company had not properly implemented their requests regarding the right to erasure (‘right to be forgotten’) and the right of access.

During the examination of the complaints it was established that the company, in its response to the applicants’ requests, indicated that it would not act on a specific request for deletion of data, because the applicant concerned did not identify in their request the ‘specific grounds’ under Article 17 of the GDPR, i.e. they did not identify a specific reason corresponding to Article 17(1) of the GDPR, and the company did not provide all the reasons for inaction, i.e. the purposes for which the applicants’ data of a specific scope would continue to be processed after the request was made.

The examination of the complaints also revealed that the company, in order to ensure the security of the platform and its users, unlawfully applied ‘shadow blocking’ (the processing of personal data with the intention that a person who allegedly violates the “Vinted” platform’s principles of operation should leave the platform without being aware of such processing of their personal data) in respect of some of the applicants, in violation of the principles of fairness and transparency. It should be noted that the improper implementation of the above-mentioned principles has negatively affected the ability of users of the platform to exercise other rights and seek remedies under the GDPR.

In addition, the company did not take sufficient technical and organisational measures to ensure the implementation of the principle of accountability and to be able to demonstrate that it had taken (or reasonably refused to take) action with regard to right of access.

When deciding on the amount of the fine, the SDPI relied on the European Data Protection Board’s Guidelines 04/2022 of 24 May 2023 on the calculation of administrative fines under the GDPR, taking into account, for example, the cross-border scope of the processing carried out by the company, the infringements affected a large number of data subjects and lasted for a long period of time.

The case concerning the imposition of an administrative fine by the SDPI was heard orally in a closed session, in the presence of representatives of the SDPI and of representatives of the company. Given that the complaints also concerned personal data of citizens of other Member States of the European Union, in accordance with the GDPR, the decision taken was also coordinated with the personal data protection supervisory authorities of those Member States, applying the ‘one-stop shop’ principle. The supervisory authorities of Germany, France, Poland, the Netherlands and Spain identified themselves as the concerned supervisory authorities.

The decision of the SDPI may be appealed to the Administrative Court of the Regions within one month from the date of delivery of the decision in accordance with the procedure laid down by the Republic of Lithuania Law on Administrative Proceedings.

Last updated: 03-07-2024

Related news:

State Data Protection Inspectorate carried out investigations focusing on data protection officers

Personal Data Breaches in Lithuania During the Year of 2023

Level of Personal Data Protection Conditions

Meeting of Personal Data Protection Supervisory Authorities of the Baltic States in 2023

Annual Report of Personal Data Protection Supervision in Lithuania in 2022