On August 26, 2024, the Dutch Data Protection Authority announced a substantial €290 million fine against Uber for breaching the EU’s General Data Protection Regulation (GDPR). Uber was found to have transferred sensitive data of its European drivers to the United States without adequate protection. The data included location information, photos, payroll records, and in some cases, details about criminal records and health.
The investigation began after over 170 Uber drivers in France filed complaints. The Dutch authority, responsible for overseeing Uber’s data practices in the EU, determined that the transfer of data from Europe to the U.S. over a two-year period did not meet GDPR standards. This incident highlighted the serious implications of cross-border data transfers and the necessity for rigorous data protection measures.
Uber, however, contested the decision, labeling it as “unjustified” and stated that the data transfer occurred during a period of “great uncertainty” between the EU and the U.S. regarding data privacy regulations. Uber plans to appeal the fine, arguing that the decision is based on a misinterpretation of the GDPR. The company claims that it has since rectified the issues identified by the Dutch authority.
Aleid Wolfsen, the head of the Dutch Data Protection Authority, emphasized the importance of safeguarding personal data, particularly when stored outside of Europe. Wolfsen noted that European regulations require companies to exercise extra caution, especially considering the differences in data protection standards between Europe and other regions, like the U.S.
This case underscores the ongoing challenges multinational companies face in navigating complex data protection laws and the severe consequences of non-compliance within the EU.
This significant penalty serves as a reminder of the EU’s stringent approach to data privacy and the responsibilities of companies handling sensitive information across borders. The outcome of Uber’s appeal will be closely watched, as it may have broader implications for data transfer practices between Europe and the United States.
