Uber must pay €290 million to the Dutch Data Protection Authority to transfer the data of its European taxi drivers to servers in the US.
advertisement
Uber has been fined €290 million in the Netherlands for transferring drivers' personal data to the US.
The Dutch Data Protection Authority (DPA) found that Uber had collected “sensitive information” about its European drivers, including taxi licences, location data and even medical data, and stored it on servers in the United States.
The DPA added that Uber made the transfers to US databases without “adequately safeguarding the data relating to these transfers.”
The DPA considers the transfer a “material breach” of Europe's General Data Protection Regulation (GDPR).
These data laws require “companies and governments to handle personal data with due care,” DPA chairman Aleid Wolsen said in a statement on its website.
“But unfortunately, this is not self-evident outside of Europe. Think of governments that can leverage data at scale.”
Fines are 'totally unjustified'
“This misguided decision and extraordinary fine are completely unjustified,” an Uber spokesperson told Euronews Next in an email.
Uber maintains that it has complied with GDPR for three years, during which there was “significant uncertainty” between the US and EU over how the rule would be applied.
According to Uber, the issue dates back to 2020, when the European Court of Justice ruled that the current EU-US data transfer framework is no longer compliant with GDPR.
In a statement supporting Uber, the Computer and Communications Industry Association Europe said Western companies had been left “without clear guidelines on transatlantic data flows” for nearly three years.
The European Commission resolved the situation in July 2023 with a statement saying the US provides sufficient protection for European data.
Uber said it hasn't had to change how it stores information in the United States as a result of the ruling.
“In the absence of a clear legal framework, the retroactive fines by data protection authorities are particularly worrying given that privacy watchdogs have failed to provide useful guidance during this period of significant legal uncertainty,” Alexandre Roulet, policy head for CCIA Europe, said in an emailed statement.
For the CCIA, the retroactive fine means legal uncertainty for anything that happens online between 2020 and 2023, from video conferencing to processing online payments.
Uber said it would appeal the fine and was “confident that common sense will prevail.” The appeal means the fine will be suspended until a final decision is made.
advertisement
Uber fined for third time in five years
The DPA launched its investigation earlier this year after 170 French drivers filed complaints in 2021 with the French NGO Ligue des droits de l'Homme (League of Human Rights).
The DPA took on the case because Uber's EMEA headquarters is in Amsterdam. Dutch authorities fined Uber 10 million euros in December last year and 600,000 euros in 2018.
In its December 2023 investigation, the DPA found that Uber had not responded quickly enough to data requests from drivers.
The French data authority, which worked with the Netherlands on the case, said Uber also provided “incomplete” information in its privacy statement about how the company transfers data to the US.
advertisement
“This decision reaffirms the importance of seeking transparent information and the need to ensure that the rights of data subjects are respected,” the French data authority said in a statement at the time.
Jerome Giusti, a lawyer for the French League for Human Rights, said in a February statement that he considered the December complaint to be “the first large-scale action by European workers under GDPR.”
“The drivers I represent are considering launching a class action lawsuit to obtain compensation following the first sentencing in the French courts.”
Euronews Next contacted the French NGO for an update on the potential lawsuit but did not immediately receive a response.
advertisement
Uber argues in its lawsuit that the DPA stated the ride-sharing platform met its obligation to provide data to drivers in a timely manner.
The company said its appeal of the December 2023 lawsuit is still ongoing.
