Lithuanian DPA imposes 2.3 million euro fine on Vinted for GDPR violations

The State Data Protection Inspectorate (SDPI), the Lithuanian data protection authority or DPA, has decided to impose a 2,385,276 euro fine on Vinted, an online platform where people can buy and sell second-hand clothing.

The SDPI launched an investigation into Vinted after numerous DPAs from EU member states forwarded complaints about the company. Because Vinted’s headquarter is in Vilnius, the capital of Lithuania, it’s up to the Lithuanian DPA to resolve the matter. This is called the ‘one-stop shop principle’.

During the investigation into Vinted, researchers found that the company wrongly asked customers to provide a specific reason for deleting their personal information. Vinted also neglected to provide a clear explanation to customers about why the company refused a deletion request.

Article 17.1 of the GDPR states that people have the right to have their personal data be deleted ‘without undue delay’. Nowhere does it say they have to provide a reason for their request. Asking for one is therefore prohibited.

Furthermore, researchers revealed that Vinted unlawfully blocked users from its trading platform. Banning a person from an online service without him or her knowing, is called ‘shadow blocking’ or ‘shadow banning’. This happened more then once after someone supposedly violated Vinted’s principles of fairness and transparency.

“It should be noted that the improper implementation of the above-mentioned principles has negatively affected the ability of users of the platform to exercise other rights and seek remedies under the GDPR,” the SDPI states.

Lastly, Vinted did not implement sufficient technical and organizational measures to safeguard the principle of accountability.

After a hearing with both representatives of the SDPI and representatives of Vinted and in accordance with the GDPR, the Lithuanian privacy watchdog decided to impose a fine on the company of almost 2.4 million euros.