[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4xPdcSqAsw9r0tynPR8M8Y7kdpwOA1xmeQYVH-nOpJc":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":123},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"7b950715-f84d-4935-8035-94d2c9145512","Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing","grindr-to-pay-26-million-to-settle-u-k-claims-over-hiv-status-data-sharing-86a44f","Online dating app Grindr has opted to pay £26 million ($35.1 million) to settle a lawsuit in the U.K. over allegations that it shared users' personal information, including their HIV status, with third-parties. Grindr, which is the largest LGBTQ+ dating app, was sued in April 2024, accusing it of violating U.K. privacy laws by sharing sensitive data for commercial purposes such as advertising.","Dating app Grindr will pay £26 million to settle a UK lawsuit alleging it shared users' sensitive personal information, including HIV status, with third parties for commercial purposes. The lawsuit, filed in April 2024, covers historical data practices before 2020. Grindr disputes the allegations but acknowledges user distress and has since revamped its privacy program.","Grindr to pay £26 million to settle UK lawsuit over sharing HIV status data.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fgrindr-to-pay-26-million-to-settle-uk.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjGUJMPbCbes7NM-EpNPWOUc7bYX5pznAZZjAl29ELdnhrIFzOBqkVtUsiDgxWvImd-yqpnCi5E4EaA1SCbnqY-_1qOwv2RnBTrjOHwn738A5TVUyZV6uX9TQyjF2EmPsJhyxHc1IcqV0jH3JraUU5s3Yw64WOCoE4WawhfajZhq7X-XvWQtVfw-S2QxbkU\u002Fs1600\u002Fgrindr.jpg","2026-09-08T07:00:43+00:00","2026-09-08T10:00:16.033077+00:00",7,[17],{"name":18,"type":19},"Grindr","product","d95477d7-eb04-4fad-a2dc-be1428040ce7",{"id":20,"icon":22,"name":23,"slug":24},null,"Privacy Fines","privacy-fines",[26,31,36,41],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":20,"icon":22,"name":23,"slug":24},[],[18],{"controls":46,"vendors":122},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"slug":77,"name":78,"problem":79,"products":80},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":106,"name":107,"problem":108,"products":109},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[110,116],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":112,"url":114,"description":115},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":117,"product_name":118,"url":120,"description":121},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":124,"title":125,"body":126,"framework_refs":127,"framework_notes":138},"grindrs-26m-hiv-data-sharing-settlement-a-costly-lesson-in-sensitive-data-governance","Grindr's £26M HIV Data Sharing Settlement: A Costly Lesson in Sensitive Data Governance","Grindr shared highly sensitive personal data — including users' HIV status — with third-party advertising partners without adequate legal basis or transparency, violating core data protection principles. This type of special category data carries the highest level of legal protection under GDPR and equivalent UK law, meaning any processing requires explicit, informed consent. The failure to implement technical and contractual controls over third-party data flows exposed users to potential discrimination, stigma, and serious personal harm. This case illustrates that commercial data-sharing practices must be rigorously audited against privacy obligations, especially when sensitive health information is involved. The £26 million settlement underscores that regulatory and litigation risk from data misuse can far exceed any short-term commercial gain.",[128,129,130,131,132,133,134,135,136,137],"GDPR Article 9 – Processing of special categories of personal data","GDPR Article 5 – Principles relating to processing of personal data (data minimisation, purpose limitation)","GDPR Article 7 – Conditions for consent","GDPR Article 28 – Processor obligations and Data Processing Agreements","UK GDPR \u002F Data Protection Act 2018","NIST Privacy Framework PR.DS-P (Data Processing Policies)","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)","ITIL Service Value Chain – Supplier Management practices",{}]