Grindr faces investigation for sharing HIV data with third parties

Grindr might be in even more hot water for sharing its users’ data after a complaint was filed against it for allegedly breaching European law.

Norwegian company, Sintef, discovered Grindr was sharing its users’ data with app analytics companies, Apptimize and Localytics.

Along with sharing HIV status the gay hook-up app was also sending the companies people’s email, GPS location, sexual identity, relationship status, ethnicity, phone ID, and what gay group they belonged to – bears, kink, daddies etc.

Grindr originally defended its decision to share the sensitive data, but backed down after a global backlash. It placed some of the onus on it users to examine ‘how and where their data is shared’.

‘The information that was shared with Apptimize and Localytics is standard industry practice for rolling out and debugging software,’ Grindr’s head of security Bryce Case said in statement.

‘Any information we provide to our software vendors including HIV status information is encrypted and at no point did we sharing sensitive information like HIV status with advertisers.

‘The key takeaway from today’s news is that Grindr strongly encourages our users to take a rigorous approach when examining how and where their data is shared, but there is a major difference between a company like Grindr sharing encrypted data with a software vendor to debug its app, and having it harvested from an outside third party like Cambridge Analytica which is not what is happening here.’

Insufficient consent

But the Norwegian Consumer Council (NCC) is not satisfied with Grindr’s decision to stop sharing data with third parties. It has filed a complaint with Norwegian Data Protection Authority claiming Grindr breached data protection law.

‘Information about sexual orientation and health status is regarded as sensitive personal data according to European law, and has to be treated with great care. In our opinion, Grindr fails to do so,’ said Finn Myrstad, director of digital services at the NCC.

The NCC argues in its complaint the Grindr’s terms of service does not get a ‘clear consent’ from its users to share data with third parties.

‘It is very disconcerting that users risk losing control over this kind of information. This is information that could be abused for surveillance, discriminatory, and marketing purposes,’ Myrstad says.

‘When Grindr transmits sensitive personal data to third parties for advertising purposes, this is outside of the original purposes for the data collection.

‘If such data sharing is to be in accordance with European law, the service has to obtain a separate and clearly given consent from the user. Grindr, who only mention sharing user data in their privacy policy, does not obtain clear consent.’

Still in shock

HIV and LGBTI advocates around the world were shocked at Grindr’s data sharing policy.

Darryl O’Donnell is the CEO of the Australian Federation of AIDS Organisations (AFAO). He said hook-up apps were important to help people negotiate safe sex. But it was crucial their sensitive information is was handled properly.

‘It’s very important hook-up apps allow people to share information about their HIV status. This allows people to be open about their HIV status and to negotiate sex safely,’ O’Donnell told Gay Star News.

‘It’s essential app users have confidence personal information such as HIV status is handled sensitively and securely.

‘This includes explicit consent for data sharing. The reports we have seen regarding Grindr are very disturbing and it’s essential that they strongly reassure their users that their data is secure.’

Grindr wants to make some things clear

Following the international backlash, Grindr did agree to stop sharing user data with Apptimize and Localytics.

But it wanted people to know it was aware things like HIV status were sensitive information.

‘As a company that serves the LGBTQ community, we understand the sensitivities around HIV status disclosure,’ said Grindr CTO, Scott Chen, in a statement.

‘Our goal is and always has been to support the health and safety of our users worldwide.’

In an effort to clear any misinformation we feel it necessary to state:

• Grindr has never, nor will we ever sell personally identifiable user information – especially information regarding HIV status or last test date – to third parties or advertisers.
• As an industry standard practice, Grindr does work with highly-regarded vendors to test and optimize how we roll out our platform. These vendors are under strict contractual terms that provide for the highest level of confidentiality, data security, and user privacy.
• When working with these platforms, we restrict information shared except as necessary or appropriate. Sometimes this data may include location data or data from HIV status fields as these are features within Grindr, however, this information is always transmitted securely with encryption, and there are data retention policies in place to further protect our users’ privacy from disclosure.
• It’s important to remember that Grindr is a public forum. We give users the option to post information about themselves including HIV status and last test date, and we make it clear in our privacy policy that if you chose to include this information in your profile, the information will also become public. As a result, you should carefully consider what information to include in your profile.
• As an industry leader and champion for the LGBTQ community, Grindr, recognizes that a person’s HIV status can be highly stigmatized but after consulting several international health organizations and our Grindr For Equality team, Grindr determined with community feedback it would be beneficial for the health and well-being of our community to give users the option to publish, at their discretion, the user’s HIV Status and their Last Tested Date. It is up to each user to determine what, if anything, to share about themselves in their profile.

Read more from Source: Grindr faces investigation for sharing HIV data with third parties