中文导读

挪威数据保护局因Xandr在广告竞价链条中违法处理Grindr用户敏感数据，对其处以9200万挪威克朗罚款。此案提出一个重要问题：看不见用户界面的广告公司，是否也必须核实用户同意？

正文

On October 12, Norway’s data protection authority announced its largest fine so far. It ordered advertising technology company Xandr to pay 92 million Norwegian kroner, about €8.6 million. The case concerned personal data from Norwegian users of Grindr, a dating app for gay, bisexual, transgender, and queer people. The authority said the information could show a person’s sexual orientation, which has special protection under European privacy law.

本段译文

10月12日，挪威数据保护局宣布了迄今为止开出的最高罚款。该机构责令广告技术公司Xandr支付9200万挪威克朗，约合860万欧元。此案涉及约会应用Grindr挪威用户的个人数据，该应用面向男同性恋、双性恋、跨性别和酷儿群体。监管机构称，这些信息可能显示一个人的性取向，而性取向在欧洲隐私法下受到特别保护。

The case shows what happens behind a simple online advertisement. When someone opens an app, information about the phone and its user may enter a system called real-time bidding. Advertising companies then compete automatically to place an ad. This happens in a fraction of a second. Xandr worked as an intermediary in this process. The authority said it passed Grindr data to potentially thousands of companies.

本段译文

此案展示了一则简单网络广告背后发生的事情。当有人打开应用时，有关手机及其用户的信息可能进入一个名为实时竞价的系统。随后，广告公司自动竞争广告位。这一过程在几分之一秒内完成。Xandr在其中充当中间商。监管机构称，它把Grindr的数据传给了可能多达数千家公司。

The investigation covered data shared from July 2018 to April 2020. It followed a complaint made in 2020 by the Norwegian Consumer Council and privacy group noyb. According to the authority, thousands of Norwegian users were affected. The risk was not limited to one advertisement. Data from different sources could be combined to create detailed profiles about people’s interests, habits, and behavior.

本段译文

调查涉及2018年7月至2020年4月期间共享的数据。调查源于挪威消费者委员会和隐私组织noyb在2020年提出的投诉。监管机构表示，数千名挪威用户受到影响。风险并不只限于一则广告。来自不同来源的数据可能被合并，从而建立关于个人兴趣、习惯和行为的详细资料。

Xandr argued that it believed Grindr had already received valid consent from users. It did not check this itself. The authority rejected that argument. It said Xandr and Grindr jointly decided how the data would be used. Therefore, each company had a duty to make sure there was a legal basis for using it. Sensitive data required clear and explicit consent.

本段译文

Xandr辩称，它相信Grindr已经取得用户的有效同意，因此没有自行核实。监管机构驳回了这一说法。该机构认为，Xandr与Grindr共同决定了数据的使用方式。因此，每家公司都有责任确保使用数据具备合法依据。敏感数据需要清楚且明确的同意。

The fine was based on Xandr’s own business size, not Microsoft’s. Microsoft bought Xandr after the period covered by the case. The company said the events happened before the purchase and that it was considering its options. Xandr has three weeks to appeal, so the decision may still be challenged.

本段译文

罚款依据Xandr自身的业务规模计算，而不是微软的规模。微软在涉案时期之后才收购Xandr。该公司表示，相关事件发生在收购之前，目前正在考虑可采取的措施。Xandr有三周时间提出上诉，因此这一决定仍可能受到挑战。

The ruling matters beyond one dating app. Most people can see the app they use, but they cannot see the long chain of firms working behind an ad. Norway’s decision says responsibility cannot simply be passed along that chain. For companies, accepting another firm’s promise is not enough; they must check and record that the data use is lawful. For users, the case explains why meaningful consent must cover not only the app on the screen, but also the less visible businesses that receive personal information.

本段译文

这项裁决的意义超出一个约会应用。大多数人能看到自己使用的应用，却看不到一则广告背后长长的企业链条。挪威的决定表明，责任不能简单地沿着这条链条转交。对企业而言，接受另一家公司的承诺并不足够；它们必须核实并记录数据使用是否合法。对用户而言，此案说明，有意义的同意不仅应涵盖屏幕上的应用，也应涵盖那些不太可见、会接收个人信息的企业。

新闻来源

Reuters · Norway fines Microsoft’s Xandr $9.6 million over Grindr data sharing

Datatilsynet · Microsoft company fined NOK 92 million

Forbrukerrådet · Microsoft-selskap ilagt bot på 92 millioner etter klage fra Forbrukerrådet

✳更多文章 →