The Gayborhood

It's like you walking into a room and saying I'll share my information with 10 people in this room And this is where it ends and then you find out actually it's just gone out to the whole world In 2020 Norwegian regulators launched a major investigation into the dating app Grindr Grindr for anyone who is unfamiliar is the world's largest gay dating app It's got an estimated 50 million monthly active users and a market cap of about two and a half billion dollars Norway for anyone who is unfamiliar Small Scandinavian country were you familiar Scott? I don't know how you could be alive these days and I'd be familiar. I feel like my 73-year-old brother with no agriders. I meant with Norway. Oh, yeah, sorry. Yes. Yes. No, no, no I'm not could you give me a background on Norway? It's known for its mountains glaciers and deep coastal fjords Okay. Okay, January 14th the Norwegian Consumer Council of the Forbes Group Credit Published as this technical and legal critique of data sharing in the country at the same time is they file an official complaint Against Grindr for their data sharing practices. The name of that report Out of control how consumers are exploited by the online advertising industry The report was mostly a team of people performing like a technical network analysis across about a dozen Dating and lifestyle apps and a lot of it has spent documenting pretty extensive data sharing with ad networks That was going on behind the scenes We're all familiar with this stuff. The report really honed in on Grindr The report described Grindr as without valid user consent sharing GPS location IP age device IDs and a bunch of other personal user data with a swath of ad and analytics partners for like behavioral advertising Surprising no not really Sadly worthy of a fine according to Norwegian law. It would seem The complaint turned into a multi-million euro fine. The fine resulted in appeal. This goes back and forth for a while Roughly during the same window of time Ronald de Hazus former head of privacy for Grindr claimed that they had fired him after he'd raised Concerns about retention and sharing practices He accused them of a corporate culture the prioritized quote profit over privacy. He gets fired falls a wrongful termination suit Courts in Norway keep ruling against Grindr through the appeals and eventually the company pays the Norwegian multi-million euro fine Bring a new management that was then this is now and they kind of try and wipe their hands with the whole mess But Norway isn't the only country with privacy laws Which brings us to the UK into our story this episode In 2024 a law firm called Austin Hayes files a claim in their high court alleging that Grindr had again there Shared sensitive data with third parties four commercial purposes without valid consent as of right now 12,000 claimants have signed on now. I want to dig into this These cases are technically different in a few interesting ways We're going to talk about the minute interview this episode But at the heart of both of these stories and these are stories about like data and privacy and what it means when we click yes to terms of use Is this idea of special category data? Special category data from what I can tell is just this idea that data is not one big homogenous thing in the eyes of the law That there is some kind of difference between say your name and email and medical data One belongs in a special legal category due to its sensitivity Call that special category data In the Norwegian case that hinged on this idea that just being a user of an app itself can be special category data Due to the fact that you can infer something about that user's sexual orientation In the UK case is a question of whether a different kind of data Medical data was ever shared with commercial partners I find this kind of thing fascinating We've talked about terms of use recently on this show Correct. Yeah, the famous number that always floats around is that it would take an average person Over 250 hours to read all of the terms of use they encounter in a year Which if we do the napkin math is equivalent to roughly 76 full-time work days Given that Jordan I've worked in the marketing advertising field, you know PII I think is the term that's commonly used in in North America personally identifiable information Protection of PII is at the forefront of all those conversations In North America anyway, and if it isn't protected information it would be in those terms of use that you would be spending Assuming a five-day work week about four months out of every year reading You're gonna want to spend Q1 reading terms of use. Yeah, please, please, and thank you That even if it's inside of terms of use I believe I can't speak for the states But I know for Canada we have laws that protect it So even if they are gathering and collecting that information through the terms of use it can't be Relayed to other people like advertisers like us. It can be generalized into large swaths of data and kind of behavioral trends and such But they can't give us anything that's personally identifiable So if we want to drill down in data the further down we get the smaller the pool is and once the pool reaches a legal size And then we can't drill down any further and just because you put something into terms of use doesn't make it legal correct ignoring the fact that no one is reading all of these things We are all kind of assuming and hoping and relying on the idea that someone somewhere up the line In the the like ladder of people making this is paying attention to whether or not these agreements are legal And then on the flip side of it that when Companies that make them violate them that something at all happens as a result. There's some kind of fallout Yeah, so if you've read any legal contracts You know that the last clause in them is always a If any part of this contract is found to be invalid illegal or otherwise the rest of the contract remains sound Always the way that they close all contracts. Yeah, sure if we made a whoopsy the rest of it's still good though, right? Yeah totally The key issue is that as far as our clients are concerned when they provided their information This is way it was supposed to stop I wanted to understand more about the story because it's it's about data and it's about privacy and it's about the law I knew that I needed to talk to Chaya Hanumanji partner and managing director of Austin Hayes the law firm bringing that claim on behalf of claimants against Grindr To understand like what was the flow of data between these apps and these ad networks What is the exact point that dodgy but technically legal business practices and and privacy violations begin and what does even mean to try and sue a company worth 2.5 billion dollars Scotch if you get into it. Let's do it. My conversation with Chaya Hanumanji on this episode of Act Chaya, thank you so much for sitting down and talk with me about this. Thanks for having me children We all give a lot of information to big companies probably on a almost daily basis at this point I was fascinated by this as a story about what it is we're actually consenting to when we give that information to a company You are leading a case now representing more than I believe it's 11,000 users of Grindr Just over 12,000. Yeah, just over 12,000. And what is it that that cases alleging the company did with those people's data So the the allegation released to a certain period so this is not a current practice But in the past it transpired that Grindr was You know collecting information as it does from users as part of them finding up to dating app And a lot of this information on Grindr is quite sensitive information because being on writing itself indicates sexual preference And then part of the information that users provide also includes Information around HIV testing days whether they have tested So it's a very very sensitive information And the allegation is that that information was shared with third potentially fourth parties without our client's consent When you talk about consent, you know, when when we give our data to these platforms We do that in the in the Expectation that if this is going to be information that gets shared further or made public that we will get told About this and when it comes to special category data there needs to be breaks visit consent given And that was not the case when it comes to to this information for that that Grindr said Seems like specifically from kind of having read through this between 2018 and 2020 seems as though Grindr shared Personal profile data including in some cases things like HIV status testing dates And that they shared it with as you said not just third party, but allegedly fourth party groups and companies I guess just to start sort of like what evidence are we looking at that shows that and who were those third and fourth Parties? Well, we have a list of the parties that it went to so It's all out in the public domain a company is like mo pub Optimized local it takes but then once, you know, this data is shared with third parties Users have no control over when How far it extends to and so this is why we say we don't know if it's third fourth parties But we do know that it was shared to a number of specific parties and that information is out there in in the public domain Hmm and those companies that you named what kind of companies are there? What is it that they do and maybe what would they even want this information for Well, we don't know many of them are advertising companies Some are not in the business of advertising or may not be But in there in the business of gathering data and trying to Use that data to optimize the use of certain apps Um You know, we we are not really interested also in whether What they do with it. I think that the key issue is that As far as our clients are concerned When they provided their information. This is why it it was supposed to stop So where did the data did end up? What was actually done with the data by these third Parties, obviously it it would matter, but it's not something we would ever be able to establish With certainty for 12,000 people uh What our clients are very upset about is the fact that they didn't have any say In sharing that information Sure, they can send it to give the information over to Grindr for the purposes of operating a dating app and not necessarily to hand it over to Some kind of commercial enterprise exactly. I mean, you know Grindr describes itself as a safe space For LGBTQ people and this is what um our clients assume when they are sharing their data A former grinder head of privacy Ronald De Hizouc had said Claimed this was kind of yours prior to this, but that after firing Claimed that they had been fired after raising concerns that the company was prioritizing I believe their quote was profit over privacy How does something like that fit into your understanding of what's happened here Well, what we can any comments on here to the extent that our clients are affected and uh what we see in the press um It's clear that Grindr has not At least for as long as we can see Uh prioritized privacy And and using the their clients data in the way they should be using it as a dating app Even now it seems like they're they're really focused on using AI tools to try and maximize um Information that their clients provide them Uh as a dating tool as a tool for for maximizing use of that data So they seem to want to spin out into different business bottles Beyond the dating app but using Client data extremely valuable client data it would seem I've seen a few different arguments from grinder and I think we'll talk about a couple of them But one was seemed seemed to kind of orbit around this idea that like we never monetized health data And then we shared it with the term they used and I didn't really understand this with service providers I'm curious if you can help me understand this like it seems as though they're admitting to having shared information With people outside of Grindr, but that it was okay based on who they shared it with What is that difference between a service provider and a commercial partner and why does that distinction matter at all to the users As far as we are concerned and our clients are concerned it doesn't matter at all Um because our case is premised on uh as I said Someone having autonomy over their data and and being allowed to make a decision as to who they share it with Um well how grind and made money out of this this is to be determined and we will find out through the process of disclosure and and various things But clearly there is value in them having done that because otherwise they wouldn't Um, they have also been you know in in not not exactly on the same case but It they have been fined by the Norwegian regulator in relation to their failures And in their their privacy policies and and the the way they have managed data It's not uh, I think it's it's it's something that people are aware of um so I would say that they need to really try and um acknowledge what their feelings have been in the past and if they want to You know try and turn a new a new leaf and and Make things right uh that's fine and that's what our clients want Uh, but I think there's got to be some basic acknowledgement that they haven't been the best in the balls and clearly There were commercial gains to be made uh out of Using people's data So my understanding of UK law which is extremely limited. I'm here in Canada Is that legally hiv and you made reference to this earlier is something called a special category it sits in special category data which is its own little special bucket over here Um under the uk general data protection regulation What does that mean what obligations that impose on a company that is handling that kind of data I mean so that there is hiv information also sectional preference that but both of these things quite important um sort of data points to The reason it's it's important is you know if if you for example Keep your information to what the NHS in the UK so this is I'm sure you're aware of for the NHS is um they have to be extremely careful about who they share this information with So even if you go and see a private doctor outside of the NHS Uh the NHS is not allowed to share information with this private doctor without you consenting to it. This is how careful you have to be around that information Um, I mean all data is you know it is is but a lot of data is is personal information or which you ought to be able to say I don't want this shared with x1z but when it comes to medical data or sexual preference data There's got to be explicit consent sought from a user before that information is shared So companies need to be very very careful around that and and I think it's it's becoming It's quite widely acceptable but this uh explicit consent is being sought across the board and indeed we've seen that Grindey's not trying to do that Last year all I wanted for Christmas was a brand new fly rod if you're a long time listener of the show you'll know that I like fly fishing So I got that rod and the first day I had it out in the spring it snapped in half This just showed that material gifts can be fleeting and sometimes we look to give our family a gift that can last a lifetime Security and stability. Did you know that nearly half of American adults say that if they lost one of the primary income earners in their household That they would be in serious financial hardship within six months Supporter of the show policy genius can help with this they can secure your future easier and more affordable than you think policy genius has thousands of five star reviews on google's and trust pilot from customers who found the best policy fit for their needs Policy genius is an online insurance marketplace that allows you to compare quotes from america's top and chairs side-by-side for free With policy genius real users have gotten 20 year two million dollar policies for just 53 dollars a month Don't wait until next year give your family the gift of security today with policy genius Had to policy genius calm to compare life insurance quotes from top companies and see how much money you could save That's policy genius calm Isn't AI great. I use it all the time helps me with research summarization You know gives me options to rewrite and redraft things allows me to Remove some sentiments or add some sentiments into things that I've written If you're the last person standing that hasn't tried AI. I highly recommend you to do in our office We use Zapier and we use it to move data from some of our cloud systems to some very eye systems It just helps streamline some of our internal processes Zapier is how you deliver on your AI strategy not just talk about it with Zapier's AI orchestration platform You can bring the power of AI to any workflow so you can do more of what matters And the best part is that Zapier is for everybody Tech expert or not teams have already automated over 300 million AI tasks using Zapier Join the millions of businesses transforming how they work with Zapier and AI Get started for free by using zapier.com/hacked. That's Zapier Z-A-P-I-E-R.com/hacked We talk about a lot of data breaches on this show when people sort of inadvertently You know let some data slip out of their hands This alternatively seems like it's this is about intentional data sharing This might be only interesting to me, but how do you go about Sort of proving that intent to share this information under like UK data protection law like would the outcome of this be the same If this had been a data leak for two reasons now one is um You know we we are law firm that considers lots of these cases People come to us. There's been lots of data breaches hacking Or cyber cyber security issues in the in the recent few months um, and we have to consider where a business itself is the victim in this situation and not the The the one who has actually created the issue and so we don't necessarily feel like you know we should really try and Go off to a business where they have been the victim Of some you know some part a criminal trying to get some kind of ransom money out of it out of them uh Even though that that there might be you know some criticism about their their systems um It's likely different if a company is really negligent, I will see Where they have the the funds to put in place certain processes to make sure data is safe And they don't do that That's You know, I would say the next step Up in terms of us thinking while yeah, they should they should be you have to be some level of competition And then you have the the case of brinder where it's it's beyond that. It's the next step up where they'd intentionally share the data And it's you know the real intention is is something that will come out in evidence We obviously don't our work um we have very uh very um Talent technical experts who are able to prove these things and then they they have helped us gather the evidence around this um But that's that's for me. It's the worst thing that you could do in terms of that sort you know in that scale Sure, there is something just intuitively different about losing information having taken from you being the victim of a theft Even if you were sort of tasked with keeping that information secure It's a very different beast than you saying look at how valuable this information we have is what can we do with it? Exactly and also realizing well, this actually is a bit more valuable data than just somebody's name. It's the uniquely sensitive nature of the data is in part what makes it so valuable Grinder Another sort of response that I've seen from them is this argument that the users have effectively consented Not just through the privacy policy that people rapidly scroll past when they're sending up through these things But that by having this stuff listed publicly on a profile the term I saw was I think it was manifestly made public This idea that you are already sharing this information publicly through the app And that that sort of functions as something of a defense in this case Why I guess don't you believe those defenses hold up here firstly? Winder hasn't filed a defense yet So we don't know exactly what their defense is to to this specific case will be Because the ones that you've mentioned I believe they've already lost Into in in other courts So you know they want to roll out the same defenses then we'll have to consider that but they haven't sure a defense kind of a win really if they do Yes exactly but I mean based on our case and what we've seen And the evidence that we have from our clients that was no consent sort of all given by our clients Um and sorry, I think you mentioned one more thing Uh, what was their second defense? I think you mentioned something else but No, I think we spoke about that one earlier There was this idea that they manifestly made a public and then earlier in the conversation we talked about um The idea that they'd never monetized it intentionally and only shared it with service providers Yes, I think this is one thing that you know our clients have given us what quite a lot of um evidence about in terms of The idea that this is sharing, you know, but publicly a number of our clients almost even openly gay And so the fact that they you know grind it would not suggest that they share this information publicly Having made their users feel Safe to firstly use the app Provide the information and then encourage them to share HIV status With the app On the basis that you know, let's make this a safe space for LGBTQ people to meet So share your information freely so that it becomes, you know, everyone can make an informed choice on who they want to date or or talk to um That's something that's that that's really upsetting to our clients That did you hear that this could be an issue or that could be suggested even I would imagine it Wouldn't feel very good to have a value like that of clarity and communication inside of a community marketed at you to get you to come into this application Only to have it sort of subverted for allegedly commercial gains Exactly um and to give you an idea, you know, it's it's very hard for people to sign up to this claim with us When they feel already violated By dating up so we know there's about a million people on grinder at any point in time In the UK the fact that we have about 12,000 clients Um, it I think it it means two things one is that not everybody feels comfortable to again put themselves out there and share the information um secondly You know, these are the people who are really really affected by it and like I said, it's not just Uh, while I wasn't out yet or my family didn't know and I wasn't given the choice to certainly There was no suggestion of this being public information Some people also feel like they're not safe anymore because they have to work in countries where it's illegal to Be gay so they have to travel to these countries and They have no idea where their data has now ended up Right and so it's causing, you know, a lot of some semi-alloc lines have had to Uh take medication. They have anxiety attacks. They they they have sleepless nights. It's Uh, so far from that that idea that they they were happy to openly publicly sharing information I hadn't considered the like international Reach of grinder as having that kind of a knock on effect for people that are potentially using the app in One area of the world that maybe They wouldn't in another and what kind of implications of privacy breach like this. This would have for those kinds of users Yes, well, you know, we don't again. We don't know. Let's say the third parties are international organizations sharing this data across the board Um, this is the issue when you sort of lose control of your Information Once it's out there in the world. It's it is literally impossible to know where it goes. It's Exactly. Well, I want to talk about the users in a minute, but You had alluded to a case in Norway A regulator there find them. I think it was six and a half million euros for unlawful data sharing It was a decision that was then upheld this year. It seems very relevant to what we're talking about How does that you know other European filing strengthen this case? Well, I think there are a number of considerations about the the Board looked at that are very transferable to our case and a number of findings that are very transferable Um, it's not an exact same case, but you know, it's it's easy to look at Hardwinder has reacted to these things how they responded and how their evidence was pulled Uh in relation to showing that they got consent for example From clients Obviously, that's another jurisdiction, but we I think it's not a stretch to assume that their practices worldwide has has been very consistent And consistently pool in terms of managing Private data probably I've seen claims that you know, this is The I've seen claims that this is sort of a mischaracterous practice But that the bigger claims seems to be that this is a older practice that this was something that happened in the past Um, we've moved on. Where are we digging up all this old stuff Um, what is your response to this and what reason do you have to believe that this has continued past say 2020? Uh, we don't know if it's continued. I mean, this is also part of you know that the process of disclosure We know for sure that it's happening for certain period Uh, but even if it is historic. I mean, you know a lot of litigation is in relation to historic behavior Uh, if a big corporate has has behaved badly in the past, uh, just because we're now five six years later doesn't mean Uh, they shouldn't Have to be some level of compensation or at least apologize to their users and you know the fact that they're just saying Well, this is in the past and we've now changed things Um, it's just not good enough Depending on what kind of time frame you're talking about everything people do wrong occurred in the past And maybe by that logic it's like oh, you can't really be held responsible for anything because that was a different person Let's let bygones be bygones also. I mean, you know, they they got found out it's not a question of this I'm saying oh, we we are now going to be you know behaving better. They got found out they got fined And it's a result of that that they've they've been forced to change some of their practices. I want to talk about You use the phrase level of compensation and we've talked to put the scale of these fines versus the scale the behavior I want to talk about scale because you know Norway 6.5 million euros That's a ton of money to Either of us or any one out there in the world, but to grinder You know, I always hear people use the metaphor when they're talking about big companies Um, say losing a case or getting a fine people always refer to it as like oh, that was just a speeding ticket for them 6.5 million euros to a two and a half billion dollar market cap company is like it's not even a speeding ticket It's like a a rounding error to someone like them When you pursue a lawsuit like this, what does accountability to a company this size look like? Well, it really You know, we have very few cases in the UK that have been brought on the basis that we have brought this case where You have 12,000 users who um can show that they have suffered distress because that's what measures level compensation in in in um UK law And so this is a little bit, you know, we are looking at levels of compensation in other areas not necessarily on a dating app So we're looking at levels of compensation for example in the medical field where data has been shared unintentionally or you know by negligence And these are the the sort of Factors that we're looking at in terms of determining what level of compensation someone could get Um, of course it also depends on their individual circumstances So some people would Be more affected than others Depending on on who they are what what sort of issues they have had um, why why their data is even more sensitive Than others Let's let's talk about them um You alluded to this earlier, but like what are some of those like real world consequences when we look at this type of misuse of data like what have your clients described you in terms of Like fear outing personal safety risks talk to me about the users of this app So I I think the vast majority of our clients would say, you know, um, they were not ready to come out to their family or friends Uh, some of our clients are in you know, I'm married in heterosexual relationships And they were on a dating app Um, no, it's not for us to judge whether they should be on this or not, but that that's their Progative whether they they decide to be on an app and then you know try to trust the trust grinder with that information Um, and then I think on the more, you know on the other scale, there's there's also what I mentioned about people feeling very anxious about troubling to certain countries Uh, some people feel They are in certain professions where they cannot be openly gay So for example, people who are in the military, um, they you know, they don't want to be Outed in this way and it's you know At the at the back of my mind sometimes when I read these things, I think of of the I think it's my actually medicine or uh Conorama that was this yeah where people people say that I was just published tried and yeah, that's not that that hasn't happened But I think people feel When when could that happen that you know if this if our data has been shared in that way who has that data When will it be that and do I now need to you know just be upfront and tell my employer I am actually gay When I wasn't ready to how do I protect myself? I think these are the sort of considerations that you know with a quote would look at Yeah, the the fear that once information is out in the world you're kind of constantly waiting for It to pop up somewhere else The Ashley Madison comparison was so apt because that information Got leaked and then there was sort of an entirely secondary Call it media political something where people started saying it's a good thing for us to take this information and shine light on it So you can search it and it's indexable and it's parsable and you can look a name up in it and see what's in there And there's all these no one could have predicted that when the original data set leaked But for those users in the middle there would have been this fear what if something happens what if something happens what if something happens and then it does So I it's that fear exactly it's the fear it's you know It's some of these things may not happen, but the fear is What creates that the distress in our clients and That's not something they can really sort of move on from even if it's full five years later And and we don't even know if you know that's that practice has stopped we don't know where the data has ended up At this point and that thus the sort of transparency we are looking for from Rinder and even if someone listening This is thinking to themselves well you sharing information piece of information with an application It is posted publicly on a profile You should accept the premise that it is going to be public those people did not consent when they share that information allegedly to that party sharing it with third parties fourth parties without with it going out into the world beyond the confines of A geolocks dating app. Yes, I mean it's you know It's like you walking into a room and saying okay, I'll share my information with ten people in this room And this is where it ends and then you find out actually it's just gone out to the whole whole world That's the difference here right one of the ten people in that room was like oh, I was live streaming this whole time Should I not have done that would you like me to have told you I was going to do that before you walked in and shared this very personal information? Huh, I guess to wrap up Like what message do you hope something like this sends to tech companies that hold this you know in some cases very deeply personal data Especially those that are marketing themselves as safe spaces for you know Different communities. Well, I think there are different things to think about because if you want to be You know a responsible company a lot of these companies want to be you know um To to promote their ESG status and and everything based then poor Um, it's very important to be able to demonstrate that they're treating people fairly so there are different ways you could do that Uh, one is obviously making sure you're getting consent properly from clients Um, but the other way of doing this in in a very equitable way is actually giving value to the data that you are sharing Um, so there there is a value to this data and the more Sensitivity your data is the more valuable it is And so giving me any other choice to say well if you are going to share this data you pay me I don't know 20 pounds 50 pounds or something or I get all I get a free subscription or whatever it might be That is the way to Recognize the value of of our data Instead of essentially stealing it and making money off of it and us not even realizing that Chai, thank you so much for sitting down talking with me about this. I found it genuinely fascinating. Thank you so much really really good to speak to you