In 2020, numerous complaints were filed against Lithuania-based second-hand specialist Vinted in France, mainly regarding difficulties experienced by individuals in exercising their right to have their data erased. As a result, the French privacy watchdog, CNIL, has fined the company over 2.3 million euros. The fine was imposed by the Lithuanian data protection authority, which forwarded the French complaints for investigation.
Vinted expressed disagreement with the decision and stated that there is no legal basis for the fine. The company believes that it sets a new precedent that surpasses current legislation and industry practices. Vinted announced that it plans to appeal the decision. Despite this, the company reassured its members that the issues highlighted by the Lithuanian Data Protection Authority do not relate to the security of their accounts or involve any misuse of their personal data.
Among the violations noted by CNIL were that Vinted did not process requests for the deletion of users’ data in a fair and transparent manner. The company was also found to have implemented a “stealth ban” system that infringes excessively on users’ rights. Additionally, Vinted failed to provide evidence that it properly responded to requests for accessing customers’ personal data.
Vinted has pledged to work with authorities in Poland, the Netherlands, and Germany to address these issues. Founded in 2008, Vinted claims over 100 million members globally and employs more than 2,000 people, primarily in Lithuania.