A Lithuania-based start-up is selling so-called reputation packages – data collected from people's social media accounts. Privacy advocates are outraged, and the Lithuanian State Data Protection Inspectorate has launched an investigation.
Buying a personal reputation report
Would you want your social media posts – whether made yesterday or ten years ago – to be sold to others? Because there might be buyers if you hold a high-profile position, wield influence, or are about to embark on a promising career. Your employer, a rival, or simply someone with ill intent could pay just a few euros to obtain your full reputation report.
This is not a hypothetical scenario. A Lithuanian company called Whitebridge AI offers precisely such a service. The start-up has already drawn criticism from privacy defenders, and the State Data Protection Inspectorate has begun an inquiry after receiving a notification from the Austrian data protection NGO NOYB (None of Your Business), which had received complaints from individuals.
“The complainants entered their own names into the Whitebridge database, and the system provided a great deal of information about them. Under the EU General Data Protection Regulation (GDPR), individuals have the right to access data held about them. Consequently, they contacted the Lithuanian company, requesting access to all such data via email, but received no reply,” explained Lisa Steinfeld, a lawyer at NOYB.
As a result, NOYB decided to conduct its own investigation – by ordering the service and seeing exactly what the Lithuanian company, which uses artificial intelligence, was selling.
“We, as a non-governmental organisation, decided to order a report ourselves and discovered what had been collected about the complainants. We found data including conclusions about people’s interests, political views, and even private adult content. Everything was organised into structured reports. The complainants then contacted Whitebridge again, asking for their data to be disclosed, deleted, or corrected – but Whitebridge did not comply,” Steinfeld said.
The Lithuanian State Data Protection Inspectorate confirmed to LRT RADIO that an investigation is under way into Whitebridge AI, focusing on the legality of personal data processing and possible breaches of GDPR provisions. The state institution declined to comment further while the inquiry continues.
Company claims it uses only publicly available data
Representatives of Whitebridge AI, a Vilnius-registered start-up, insist they have not broken any laws and that they rely solely on publicly available information.
“Our organisation takes data protection and privacy extremely seriously. All the personal data processed by our company is collected only from publicly available sources, and only for lawful and clearly defined purposes. I’d like to stress that we do not proactively collect or store personal data,” Whitebridge CEO Paulius Taraškevičius told LRT RADIO.
He explained that the company gathers information from social media profiles.
“The information we use is taken from social media profiles where privacy settings do not restrict visibility. It can also come from public news websites or other open sources, such as sanctions databases,” said Taraškevičius.
He added that all ordered reports are later deleted:
“All reports ordered through our platform are erased after 30 days and cannot be accessed afterwards.”
However, NOYB’s legal expert Steinfeld disagrees, arguing that such data collection requires individuals’ consent – which Whitebridge never sought.
“People whose data has been gathered have no contractual relationship with Whitebridge. They are unaware that information about them has been collected and is being sold. Under GDPR, individuals have the right to know this. There are strict conditions under which such activities can take place, but none of them have been met by Whitebridge,” Steinfeld said.
Grey areas
Virginijus Sinkevičius, a Lithuanian member of the European Parliament, noted that this area of data protection still contains many grey zones that companies exploit.
“Europeans are better protected, but a large grey area remains – especially concerning so-called ‘consent’. When you download any app, you’re presented with a lengthy agreement. I doubt there are many people on this planet who actually read those hundreds of pages drafted by top lawyers, effectively granting consent for data collection. Many companies use this loophole to gather information,” Sinkevičius explained.
He added that personal data on social networks has long been a valuable commodity for both businesses and politicians.
According to Sinkevičius, personal data is often used for marketing purposes – to offer consumers targeted ads or predict their behaviour. However, beyond commercial use, such data can also be employed for political advertising during electoral campaigns.
How the investigation into the Lithuanian company selling reputation packages will end remains uncertain. The courts may ultimately decide the matter. However, Lithuania’s name has already reached international media, and commentators in the West are warning that such data packages could be exploited by criminals – for instance, blackmailers obtaining your old photos or posts.
NOYB lawyer Steinfeld emphasised that it is time to recognise that people’s digital footprints are part of their private property.
“We need to understand that information people share on social media is not public data. Whitebridge is mistaken in assuming otherwise. Individuals usually post for personal reasons – for a closed circle of friends or a private audience. No company has the right to turn that information into a commodity to be traded without the person’s consent,” Steinfeld said.
Whether personal data about anyone in the world will continue to be sold now depends largely on the position taken by the Lithuanian State Data Protection Inspectorate.
Newsletter
Every Friday morning.
