Dutch regulator fines Uber €290 million for unsafe transfer of drivers' data to U.S.

The Dutch Data Protection Authority (AP) fined Uber 290 million euros for transferring European drivers’ personal data to the United States without proper safeguards. According to the AP, Uber has now ended this “serious violation of the General Data Protection Regulation (GDPR).”

"In Europe, the GDPR protects the fundamental rights of people by requiring businesses and governments to handle personal data with due care," said AP chairman Aleid Wolfsen. "But sadly, this is not self-evident outside Europe. Think of governments that can tap data on a large scale. That is why businesses are usually obliged to take additional measures if they store the personal data of Europeans outside the European Union. Uber did not meet the requirements of the GDPR to ensure the level of protection of the data with regard to transfers to the US. That is very serious."

According to the AP, Uber collected sensitive data of EU drivers and stored it on servers in the U.S. This included things like location data, photos, payment details, identity documents, and even drivers’ medical or criminal data. For over two years, Uber transferred this data to the U.S. without the necessary safeguards. Uber started using an acceptable privacy shield at the end of last year but must still pay for the period in which it did not protect its EU drivers’ data.

Uber has indicated that it intends to object to the fine.

The Dutch regulator launched this investigation after over 170 French drivers complained to their local human rights organization. According to EU rules, the Data Protection Authority in the country in which the business has its main establishment is responsible for enforcing the rules on that company. Uber’s European headquarters are in the Netherlands.

This is the third fine the AP has imposed on Uber. In 2018, it fined the ride-hailing company 600,000 euros for failing to report a data breach according to the rules. Last year, it fined Uber 10 million euros also for not handling its drivers’ data with due care. Uber has also objected to the latter fine.