File processing: Paris, 4th December 2024
Ref. no.:
Referral N°
(to be included in all correspondence)
Dear Mr. ,
I am following up on the exchange of emails that took place during the investigation of complaint
P44-36647 between the services of the Commission nationale de l'informatique et des libertés
(hereinafter "the CNIL") and the data protection team of the legal entity ,
designated as the Data Protection Officer for your company.
This complaint concerned the obligation placed on partner drivers (hereinafter referred to as
"partners") using the application to prove that they have an order form when a customer
cancels a journey and the application detects that the partner has travelled to the vicinity of the
cancelled journey. The CNIL was informed that if this justification was not provided, the
application would deduct the equivalent of the journey from the income of the partner concerned.
The CNIL's attention was drawn to the fact that, on the one hand, the transmission of an order form
from another application would lead to the disclosure of personal data and that, on the other hand,
the journey made could be private.
With regard to the processing carried out in this way, I have taken note of the fact that your
company's departments have confirmed that, between August 2020 and the end of December 2023,
they asked partner users of its application to send it an order form when they had travelled close to
the location of a cancelled journey. Your departments have indicated that the processing carried out
was based on your company's legitimate interest in combating fraud and abusive cancellations and in
deducting its commission on a journey, due in return for its service of putting the partner and the
customer using the platform in contact with each other. In fact, they specified that it was considered
that when partners cancel a journey when it has actually taken place, commission must be deducted.
In this respect, I have also taken note of the fact that in implementing this processing, your
company's intention was not to process personal data but to collect the information necessary to
carry out checks (itinerary of the journey made, date and time), excluding the passenger's name or
any other identifying information. In this respect, I note that your departments have indicated that
VTC platforms make it possible, in the driver's history, to identify this information without
mentioning the passenger's name.
I therefore take note of the fact that the purpose of this collection was not to process personal data
and that, in the event that personal data would have been processed, the processing would only have
been carried out on an occasional and residual basis, and that the risk to the rights and freedoms of
the data subjects is low.
I have also taken note of the fact that, contrary to what was indicated to the CNIL, your
departments have indicated that, in the absence of proof from the partner driver, your company does
not deduct the equivalent of the amount of the journey from his income but the amount of his
commission for the journey in question.
Finally, I note that your company has adapted its procedure as soon as the CNIL has intervened at
the end of December 2023 in order to stop collecting purchase orders, given that they are likely to
contain protected personal data.
In this context, the answers provided by and the measures taken lead me, in agreement
with the other European Data Protection Authorities concerned by your processing operations, to
close this complaint.
However, the CNIL reserves the right, in the event of further complaints, to make use of all the
powers conferred on it by the provisions of the GDPR and Act no. 78-17 of 6 January 1978 as
amended relating to information technology, files and freedoms.
Yours sincerely
For the Chairwoman of the CNIL, and by delegation,
Copy by email: Data Protection