Vinted, Europe's largest second-hand retail platform and Lithuania's first unicorn startup, improperly handled personal data and violated the European Union's General Data Protection Regulation (GDPR), a Lithuanian court has ruled.
The Regional Administrative Court on Thursday dismissed the company's appeal seeking to overturn decisions by Lithuania's State Data Protection Inspectorate (VDAI).
"The inspectorate's decisions were based on both facts and legal norms," the court said in a press release.
It added that it found that the watchdog "acted within its competence and did not exceed the scope of the complaints".
Vinted commented that “the cases raised by the VDAI are in no way related to the security of member accounts and do not involve any misuse or breach of personal member data”, adding it believed the claims to be unfounded.
“These cases are mainly based on how we communicated with people about their data deletion request; some measures we used (but no longer use) to block people who had infringed our T&Cs; and our record-keeping in regards to one single response to a request for data access,” the company said in a comment sent to LRT.lt.
Following a review of complaints forwarded by France's national data protection authority, the Inspectorate concluded in February 2024 that Vinted had failed to properly handle customer requests to delete their data, failed to sufficiently and clearly explain the reasons for blocking their accounts, and failed to provide sufficient information about its data processing practices.
Vinted argued in court that it had properly assessed deletion requests and provided all necessary information, and had neither compromised user privacy nor endangered data security.
Last July, the Inspectorate fined Vinted 2.385 million euros over data protection violations following complaints from customers in France and Poland.
Vinted has challenged the fine in court, but the case is on hold until the latest ruling on personal data handling becomes final. The ruling can be appealed to the Supreme Administrative Court of Lithuania within 30 days.
Newsletter
Every Friday morning.
