Dutch Authorities Fine Uber €290 Million Over Unlawful EU Driver Data Transfers To US

Uber has been fined €290 million by Dutch authorities for unlawfully transferring European drivers’ personal data to the United States. The Dutch Data Protection Authority (DPA) discovered that Uber had transferred sensitive information, such as taxi licenses, location details, and medical records, to its U.S. servers without properly safeguarding the data as required by European regulations.

The DPA emphasized that these data transfers breached EU laws, which mandate businesses to handle personal information with utmost care. Aleid Wolfsen, Chairman of the DPA, noted that while Europe enforces strict data protection standards, the same cannot be said for all governments. “In some countries, data is tapped on a massive scale,” Wolfsen commented in a statement.

ALSO READ: Vietnam Appoints New Deputy PMs, Ministers, Court Leaders

In response to the ruling, Uber has expressed its disagreement, labeling the fine as “unjustified.” A spokesperson for the company stated that Uber adhered to GDPR regulations amid the ongoing uncertainty between the EU and the U.S. regarding data privacy standards. According to Uber, the dispute stems from a 2020 ruling by the European Court of Justice, which invalidated the existing EU-U.S. data transfer framework.

Despite a new agreement reached in July 2023 by the European Commission affirming U.S. data protections, Uber maintains that no changes were needed to its data storage practices. Uber further criticized the retroactive nature of the fine, arguing that businesses faced a lack of clear guidance during the three-year period of legal ambiguity.

Uber plans to appeal the fine, which is currently suspended until a final decision is made.

The investigation was triggered by a 2021 complaint from 170 French Uber drivers who raised concerns about their data being mishandled. The case was taken up by the DPA as Uber’s European headquarters are based in Amsterdam. This is not the first time Uber has faced penalties in the Netherlands, having been fined €10 million in December 2023 and €600,000 in 2018 for similar violations.