Vinted, an online marketplace for the second-hand sale of goods and Lithuania’s first “unicorn”, has been fined almost 2.39 million euros for consumer data protection rules violations.
The fine was imposed following the examination of complaints forwarded by the French and Polish supervisory authorities and after the company was found in breach of the General Data Protection Regulation, Lithuania’s State Data Protection Inspectorate said on Wednesday.
The watchdog says it has carried out an investigation into Vinted’s allegedly inadequate implementation of requests from customers in those countries for their right to have their data erased (the right to be forgotten) and access to their data.
It was determined that Vinted refused to delete the data because the applicants did not identify the “specific grounds” set out in the GDPR, nor did the company specify the purposes for which the processing of the applicants’ specific data would continue.
It was also found that in order to ensure the security of the platform and its users, Vinted unlawfully subjected some of its users to shadow banning, the practice of processing personal data with the aim of making a person who may be in breach of the Vinted principles leave the platform without being aware of such processing of their data.
The decision can be appealed to the Regional Administrative Court within one month.
In its 2023 report, Vinted said the Lithuanian inspectorate made several decisions in February on individual GDPR violation cases and stated that it would initiate the procedure of imposing a fine and its eventual size would be determined by courts.
“The possible maximum fine for a GDPR breach, if any, could be up to 4 percent of the total annual global turnover, but there is no reason to believe that the maximum fine will be imposed,” Vinted says.
In October 2023, Vinted told BNS it was embroiled in litigation in Poland and Italy over millions of euros in fines. The company was also in a dispute with a consumer group over compensation for fees for platform users in France.
In May 2023, a Polish court cut the Office of Competition and Consumer Protection’s 1.14-million-euro fine imposed on Vinted by more than four times, but the ruling was appealed and is pending.
In November 2022, the Italian Competition Authority fined the Lithuanian “unicorn” 1.5 million euros for improper advertising. Vinted paid the fine but also appealed the ICA’s decision.
In France, a class action lawsuit was also filed against Vinted in May 2021 by the country’s consumer group UFC-Que Choisir for misleading Vinted users, asking a Paris court to order the Lithuanian company to pay compensation for the fees that the platform has been mischarging its members since 2016. The case is still pending before a Paris civil court.
Vinted posted a loss of 20.4 million euros for 2022, but went back into black the next year, earning a net profit of 17.8 million euros as its revenue jumped 61 percent to 596.3 million euros, from 370.2 million euros in 2022.
The headline was amended on July 4, 2024, to reflect that Vinted was fined for data protection rules violations, not data breaches.
Newsletter
Every Friday morning.
