Uber Hit With €290M Fine By Dutch Authorities Over Data Transfer Breach

Uber Hit With €290M Fine By Dutch Authorities Over Data Transfer Breach

Uber, the popular ride-hailing app, has been fined 290 million euros (approximately $324 million) by the Dutch Data Protection Authority (DPA) for violating European Union data protection laws. The penalty stems from Uber’s transfer of personal data of European drivers to U.S. servers without adequate safeguards, which the DPA has deemed a “serious violation” of the EU’s General Data Protection Regulation (GDPR).

The sensitive data involved included taxi licenses, location information, photos, payment details, identity documents, and in some cases, even criminal and medical records. Over a period of two years, this information was transferred to Uber’s headquarters in the U.S. without using appropriate transfer tools to ensure the data’s protection.

Aleid Wolfsen, Chairman of the DPA, stated, “Uber did not meet the requirements of the GDPR to ensure the level of protection to the data concerning transfers to the US. That is very serious.”

In response, Uber has expressed its intent to appeal the decision. An Uber spokesperson stated, “This flawed decision and extraordinary fine are completely unjustified… We will appeal and remain confident that common sense will prevail.”

The case highlights the ongoing challenges and complexities surrounding cross-border data transfers between the EU and the U.S., particularly under the stringent regulations of the GDPR.