Vinted under scrutiny by European data protection authorities
The online clothing sales website vinted.com, operated by the Lithuanian company Vinted UAB, has recently had to face a large number of complaints regarding data protection aspects. The appeals were addressed to several national supervisory authorities, which, as a result, joined forces to investigate the website’s overall compliance with the GDPR. To this end, a task force was established, supported by the European Data Protection Board (EDPB), which held its first meeting on November 8th, 2021.
Vinted’s headquarters are located in Lithuania, which makes the State Data Protection Inspectorate (Lithuanian data protection authority) the leading supervisory authority. However, the platform is available in several other countries in Europe, whose supervisory authorities also received the aforementioned complaints. For this reason, the establishment of the task force was jointly decided by the national supervisory authorities from France, Lithuania and Poland. The aim of this task force is to ensure a coordinated approach to resolving the complaints received. It shall also enable a consistent and efficient examination of the compliance of Vinted’s data processing practices with the provisions of the GDPR.
The investigations focus in particular on the following issues:
- website operator’s requirement to upload a scan of the user’s identity card in order to unblock funds received from sales on the corresponding account and the relevant legal basis,
- procedure and criteria for blocking the user’s account and
- applicable data retention periods.
This is not the first time Vinted has been accused of controversial practices. Back on May 18th, 2021, the French consumers group UFC Que Choisir filed a class-action lawsuit with 16 million users against the company for “misleading business practices.” These are said to consist of charging an allegedly optional commission on every transaction, the amount of which only appears at the time of payment.