10月12日：挪威数据保护局周一表示，因非法将Grindr用户的敏感数据转发给数千家广告商，对微软旗下广告技术部门Xandr处以9200万克朗（961万美元）罚款。
Oct 12 : Norway's data protection authority has fined Microsoft's adtech unit Xandr 92 million crowns ($9.61 million) for unlawfully relaying Grindr users' sensitive data to thousands of advertisers, it said on Monday.
Xandr在2018年7月至2020年4月期间，将Grindr用户的性取向数据在自动化广告拍卖中转发给公司。Grindr是一款面向LGBTQIA+人群的约会应用。
Xandr relayed data revealing the sexual orientation of users of Grindr, a dating app for LGBTQIA+ people, to companies in automated ad auctions from July 2018 to April 2020.
这是挪威数据保护局迄今开出的最高罚款，罚的对象是广告中介而非应用本身。监管机构表示，买卖个人数据的公司不能将责任推给他人。
It is the biggest fine the Norwegian authority has issued, and targets the advertising middlemen rather than the app itself. The regulator said companies that traded in people's data could not pass the blame to others.
挪威数据保护局曾在2021年因同样的违规行为对Grindr处以6500万克朗罚款。
The data protection authority fined Grindr 65 million crowns over the same breaches in 2021.
该罚款基于Xandr的收入计算，而非微软的收入，因为当时微软尚未收购该部门。Xandr有三周时间提出上诉。
The fine was based on Xandr's revenue, not Microsoft's, which did not own the unit at the time. Xandr has three weeks to appeal.
数据保护局称，Xandr认为Grindr已经获得了用户同意且从未核实，但该局驳回了这一理由，认为Xandr与Grindr承担共同法律责任。微软表示，用户隐私是首要任务。
Xandr said it assumed Grindr had obtained users' consent and never checked, the data protection authority said. It rejected that argument and ruled Xandr shared legal responsibility with Grindr. Microsoft said the privacy of users was a top priority.
“此次调查和决定聚焦于微软收购Xandr之前的行为，在此期间，法律标准和实践的解释与应用一直在不断演进。我们正在审查该决定并评估我们的选择。”微软如是称。
"This investigation and decision focused on conduct that predates Microsoft's acquisition of Xandr, and in that time the interpretation and application of legal standards and practices has continued to evolve. We are reviewing the decision and assessing our options," it said.
该案源于2020年挪威消费者委员会的投诉，该委员会的研究揭露了应用如何共享用户数据；奥地利数据隐私组织noyb也参与其中，并称该决定“是一个宝贵的先例”。
The case began with a 2020 complaint by the Norwegian Consumer Council, whose research exposed how apps shared user data, and Austrian data privacy organisation noyb, which called the decision "a valuable precedent".