Description
The Dutch Data Protection Authority (DPA) fined Uber €290 million for violating the General Data Protection Regulation (GDPR). Uber transferred sensitive personal data of European drivers (including location data, photos, payment details, and even criminal and medical data) to the US without adequate safeguards. This happened for over two years, initially without using any transfer tools, and later without using Standard Contractual Clauses after the invalidation of the EU-US Privacy Shield in 2020. This left the data vulnerable and insufficiently protected.
The investigation was initiated after complaints from over 170 French Uber drivers, who reached out to the French human rights group, Ligue des droits de l’Homme (LDH), which subsequently submitted a complaint to the French DPA. As Uber's European headquarters is in the Netherlands, the Dutch DPA acted as the Lead Supervisory Authority and co-ordinated the investigation and decision with other European DPAs.
Uber has since rectified the issue by adopting the successor to the Privacy Shield. However, the company has indicated its intention to object to the €290 million fine, which was calculated based on Uber's worldwide annual turnover. This is the third time the Dutch DPA has fined Uber for data protection violations, with previous fines imposed in 2018 (€600,000) and 2023 (€10 million). Uber has also objected to the 2023 fine.
- Keywords
-
privacy and data protection
- Actors
-
Administrative authority
- Sector
-
Transportation and storage
Sources