In 2020, the French privacy watchdog, CNIL, announced that it had fined Vinted, a popular second-hand specialist, over 2.3 million euros following numerous complaints filed in France against the Lithuania-based company. The complaints mainly centered around difficulties experienced by individuals in exercising their right to have their data erased.
Vinted expressed disagreement with the decision, stating that there is no legal basis for the fine and that it sets a new precedent that surpasses current legislation and industry practices. The company announced that it plans to appeal the decision. They reassured their members that the issues highlighted by the Lithuanian Data Protection Authority do not relate to the security of their accounts or involve any misuse of their personal data. Vinted stressed that they take privacy protection and GDPR compliance seriously and have invested significantly in data protection measures.
The Lithuanian data protection authority imposed a fine of 2,385,276 euros on Vinted after forwarding French complaints for investigation. Among the violations noted by CNIL were that Vinted did not process requests for the deletion of users’ data in a fair and transparent manner. The company was also found to have implemented a “stealth ban” system that infringes excessively on users’ rights. Additionally, Vinted failed to provide evidence that it properly responded to requests for accessing customers’ personal data. The company has pledged to work with authorities in Poland, the Netherlands, and Germany to address these issues.
Vinted claims over 100 million members globally and employs more than 2,000 people primarily in Lithuania. Despite this success, recent controversies surrounding privacy concerns have affected its reputation negatively
