Dutch regulator fines Uber €290m for transferring drivers’ data to US

Ride-hailing service failed to provide adequate protection to data generated in EU

Trade

Dutch regulator The Personal Data Authority has fined Uber €290 million under the General Data Protection Regulation (GDPR) for transferring personal data of European cab drivers to the United States without adequate adequate protection.

The Authority found Uber collected sensitive information from drivers in Europe and stored it on servers in the US. This included account information and cab licenses, location data, photos, payment information, IDs, and in some cases even criminal and medical data.

Uber transmitted that data to its US headquarters in San Francisco for more than two years without using a transfer tool that anonymised information.

The EU Court of Justice declared Privacy Shield – the legal tool ensuring data on European citizens would not be transferred to the US – invalid in 2020. According to the Court, model contracts could still provide a valid basis for data transfers to countries outside the EU. But only if an equivalent level of protection can be guaranteed in practice. Because Uber did not use a model contract as of August 2021, the data of EU drivers was inadequately protected, according to the Personal Data Authority.

Uber has been using the successor to Privacy Shield – the EU-US Data Privacy Framework – since late last year.

The Authority launched an investigation into Uber after more than 170 French drivers filed a complaint with the Ligue des droits de l’Homme (LDH), a French human rights advocacy organisation. LDH then filed a complaint with the French privacy regulator.

The GDPR regulates that companies processing data in different EU countries have to deal with one privacy regulator: the one in the country where the company is based. Uber’s European headquarters is in the Netherlands. During the investigation, the AP worked closely with the French regulator and coordinated the decision with other European regulators.

This is the third fine imposed by the AP on Uber. In 2018, it was hit with a €600,000 fine on Uber, and in 2023, a €10 million fine. Uber objected to the latter fine.

Read More: law Uber