Uber has to pay the Dutch data protection agency €290 million for transferring European taxi drivers’ data to servers in the United States.
ADVERTISEMENTUber has been fined €290 million in the Netherlands for transferring drivers’ personal data to the United States.
The Dutch Data Protection Agency (DPA) found that Uber collected "sensitive information" about its European drivers, such as taxi licenses, location data, and even medical data and retained it on US servers.
Uber made the transfers to its US databases without "appropriately safeguard[ing] the data with regard to those transfers," the DPA added.
The DPA considers this transfer a “serious violation” of Europe’s General Data Protection Regulation (GDPR).
These data laws require "businesses and governments to handle personal data with due care," Aleid Wolsen, the DPA’s chairman, said in a statement on their website.
"But sadly, this is not self-evident outside Europe. Think of governments that can tap data on a large scale".
Fine 'completely unjustified'
"This flawed decision and extraordinary fine are completely unjustified," an Uber spokesperson told Euronews Next in an email.
Uber maintains they were compliant with the GDPR over three years of "immense uncertainty" between the US and the EU about how the rules would be applied.
The issue, according to Uber, dates back to 2020, when the EU's court of justice determined that the current EU-US data transfer framework no longer complied with the GDPR.
European and American companies were “left without any clear guidelines for transatlantic data flows” for nearly three years, according to a statement in support of Uber from the Computer & Communications Industry Association (CCIA Europe).
The European Commission resolved the situation in July 2023, by issuing a statement saying the United States offers enough protection for European data.
Uber said it didn’t have to make any changes to how they store information in the US when this judgement was made.
"Any retroactive fines by data protection authorities are especially worrisome given that these very privacy watchdogs failed to provide helpful guidance during this period of significant legal uncertainty, in absence of any clear legal framework," Alexandre Roure, CCIA Europe’s Head of Policy, said in an emailed statement.
To the CCIA, retroactive fines mean there would be legal uncertainty for anything that happened online between 2020 and 2023, from video conferencing to the processing of online payments.
Uber said they will be appealing the fine and "remain confident that common sense will prevail". Their appeal means the fine is suspended until a final decision is made.
ADVERTISEMENTThird fine for Uber in five years
The DPA launched their investigation earlier this year after 170 French drivers complained to the French NGO Ligue des droits de l’Homme (Human Rights League) in 2021.
Uber’s headquarters for Europe, the Middle East and Africa is in Amsterdam, so the DPA took on the case. Dutch authorities also fined Uber €10 million last December and €600,000 in 2018.
The DPA found in its December 2023 investigation that Uber did not respond to data requests from their drivers quickly enough.
Uber also provided "incomplete" information in their privacy statement about how the company was transferring data to the US, according to France’s data authority, which worked with the Dutch on the case.
ADVERTISEMENT"This decision reaffirms the importance of requiring transparent information and the need to ensure that the rights of data subjects are respected," France’s data authority said in a statement at the time.
Jerome Giusti, the lawyer for the French Human Rights League, said in a February statement that he believes the December complaint was "the first large-scale action by workers in Europe based on GDPR".
"The drivers that I represent are considering initiating a group action to obtain compensation, following this first sentencing decision before the French courts".
Euronews Next followed up with the French NGO to get an update on a possible lawsuit but did not get an immediate reply.
ADVERTISEMENTUber maintains in that case that the DPA said the ride-sharing platform fulfilled its obligations to deliver data in a timely manner to its drivers.
The company said their appeal on the December 2023 case is still active.
