Uber incurs substantial fines due to illegally sharing driver information.
The Dutch Data Protection Authority levies a €290 million fine on ride-hailing service Uber, citing breaches of European data protection regulations. The fine stems from allegations that Uber transferred personal data of its European drivers to the US without sufficient safeguards. Uber has announced its intention to challenge the decision.
The Dutch Data Protection Authority asserted that the unprotected data transfers had occurred for over two years, constituting a significant violation of the EU's General Data Protection Regulation. The regulation necessitates technical and organizational measures to shield data.
The investigation was prompted by complaints from over 170 Uber drivers in France. The Dutch authority became involved due to Uber's European headquarters being based in Amsterdam.
Uber's alleged data protection infractions stem from a ruling by the European Court of Justice (ECJ) which declared the Privacy Shield agreement between the US and EU as invalid. The court cited potential US government spying on personal data as the reason. Following the ECJ ruling, standard contractual clauses in contracts could have allowed data transfers outside the EU, but only if they could guarantee an equivalent level of protection in practice. However, Uber failed to apply such clauses after August 2021, leaving EU drivers' data insufficiently protected. Since the end of 2023, Uber has been utilizing the successor to Privacy Shield, the Data Privacy Framework, hence ceasing the violation of rules from that point.
Uber dismissed the fine as flawed and "wholly unwarranted," and it will contest the decision. The company argued that it had adhered to the General Data Protection Regulation in cross-border data transfers amidst a three-year period of uncertainty between the EU and the US. Ultimately, Uber expressed optimism that common sense would prevail during the planned appeal process.
This is not the first time the Dutch authority has fined Uber. In January, data protectors imposed a €10 million fine on Uber for failing to disclose how long it stored data from drivers in Europe or the non-European countries with which it shared the data.
The Commission, in response to such incidents, has the power to adopt implementing acts laying down the rules for the application of data protection regulations, ensuring compliance and preventing future breaches. Despite Uber's argument of adherence to regulations during a period of uncertainty, the insufficient application of necessary safeguards led to non-compliance with these rules.
