In a major blow to the Lithuanian data protection authority, Vinted has been fined over 2.3 million euros by the French privacy watchdog, CNIL. The fine was imposed after numerous complaints were filed in France in 2020 against the Lithuania-based second-hand specialist. These complaints mainly centered around difficulties individuals faced in exercising their right to erasure of data.
Vinted has expressed disagreement with the decision and stated that it has no legal basis and sets a new precedent beyond current legislation and industry practices. The company plans to appeal the decision, but reassured its members that the cases mentioned by the Lithuanian Data Protection Authority were not related to the security of their accounts or any misuse of their personal data.
The CNIL noted several failings on Vinted’s part, including a lack of transparency in processing requests for deletion of users’ personal data, a “stealth ban” system that infringed on users’ rights, and an inability to demonstrate proper response to requests for access to customers’ personal data.
Despite these issues, Vinted remains popular worldwide with over 100 million members across Europe and beyond. The company plans to cooperate with authorities in Poland, the Netherlands, and Germany regarding this issue as indicated by CNIL.