法国CNIL一站式配合视角：UBER被荷兰监管机关AP处罚2.9亿欧元案
On 22 July 2024, in cooperation with the CNIL, the Dutch Data Protection Authority fined UBER B.V. and UBER TECHNOLOGIES INC. €290 million for transferring personal data outside the EU without sufficient guarantees.
2024年7月22日，荷兰数据保护监管机关与法国CNIL合作，对UBER B.V.和UBER TECHNOLOGIES INC.处以2.9亿欧元的罚款，因为其在没有充分保证的情况下将个人数据传输到欧盟以外。
UBER includes UBER B.V., a Dutch company based in Amsterdam, and UBER TECHNOLOGIES INC, a US company headquartered in San Francisco. UBER publishes a platform that connects VTC drivers with users.
UBER包括位于阿姆斯特丹的荷兰公司UBER B.V.和总部位于旧金山的美国公司UBER TECHNOLOGIES INC。UBER发布了一个将VTC驾驶员与用户连接起来的平台。
The CNIL received a collective complaint from the associationLa Ligue des droits de l'Homme, representing more than 170 UBER drivers. The complaint concerned in particular the information provided to individuals and the transfer of personal data outside the European Union. On 11 December 2023, the Dutch authority imposed a first fine of ten million euros for a number of breaches to inform drivers.
CNIL收到了代表170多名UBER司机的La Ligue des droits de l'Homme的集体投诉。该投诉特别涉及向个人提供的信息以及将个人数据转移到欧盟以外的情况。2023年12月11日，荷兰数据保护监管机关对一系列违规行为处以1000万欧元 (详见此处：https://www.cnil.fr/en/uber-dutch-data-protection-authority-imposes-eu10-million-fine）的首次罚款并告知司机。
Cooperation with the CNIL throughout the procedure
荷兰监管机关在监管过程中与法国CNIL合作
Under the procedures for cooperation between authorities introduced by the General Data Protection Regulation (GDPR), the Dutch data protection authority was responsible for conducting the investigations in this case, as UBER has its main establishment in the Netherlands.
根据《通用数据保护条例》（GDPR）引入的监管机关间的合作程序，荷兰数据保护监管机关负责对此案的调查，因为UBER的主要机构设在荷兰。
The CNIL cooperated closely with its counterpart throughout the procedure, at the time of the investigations and the analysis of the evidence obtained, and then when examining the draft decision as part of the one-stop shop procedure.
在整个程序中，在调查和分析所获得的证据时，以及在作为一站式程序的一部分审查决定草案时，CNIL与荷兰数据保护监管机关密切合作。
The infringement of the GDPR
违反GDPR
As a result of its investigations, the Dutch Data Protection Authority has found that the processing of drivers' personal data for which UBER B.V. and UBER TECHNOLOGIES INC. are jointly responsible is subject to transfers to the United States. The Dutch authority points out that between 6 August 2021 and 21 November 2023 (the date on which Uber was included on the Data Privacy Framework (DPF) list), these transfers between UBER B.V. and UBER TECHNOLOGIES INC. were not subject to appropriate safeguards. It concludes that there has been a breach of Article 44 of the GDPR. The CNIL has informed the complainants of this decision in accordance with the GDPR.
经过调查，荷兰数据保护监管机关发现，UBER B.V.和UBER TECHNOLOGIES INC.共同负责的驾驶员个人数据处理可能会被转移到美国。荷兰数据保护监管机关指出，在2021年8月6日至2023年11月21日（优步被列入数据隐私框架（DPF）名单的日期）期间，UBER B.V.和UBER TECHNOLOGIES INC.之间的这些数据传输没有采取适当的保障措施，结论是违反了GDPR第44条。CNIL已根据GDPR将这一决定告知投诉人。
文章来源：CNIL官网：https://www.cnil.fr/en/data-transfers-outside-eu-uber-fined-eu290-million
