Lithuania's privacy regulator (SDPI) has fined Vinted, a digital platform on which people can buy and sell second-hand clothes, €2,385,276. The investigation into Vinted also involved complaints from the Netherlands.
Vinted - an organization of Lithuanian origin - did not adequately inform users about the processing of their personal data. Vinted also did not properly respond to requests from users who wanted to view or have their personal data deleted. In doing so, the organization violated the General Data Protection Regulation (AVG).
The Lithuanian regulator launched the investigation into Vinted in response to complaints from several European member states, including the Netherlands. The Personal Data Authority (AP) regularly receives complaints about Vinted. Because Vinted's European headquarters is located in Lithuania, the AP transfers these complaints to the Lithuanian regulator for investigation.
The investigation into Vinted found, among other things, that the organization improperly asked customers to provide a specific reason for deleting their personal data. Also, Vinted itself did not clearly explain to customers why the company refused a deletion request.
The investigation also revealed that Vinted was allegedly using "shadow blocking. Shadow blocking, also known as "shadow banning," is excluding a user from the platform without the user's knowledge. This occurred after a user allegedly violated Vinted's rules of conduct. The way Vinted applied this measure unfairly prevented users from using their privacy rights under the AVG.
Both in assessing the complaints and in the making of this decision, the Lithuanian regulator worked closely with the AP and the French and Polish regulators within the cooperation mechanism of European privacy regulators, the EDPB.
