Uber receives €290m fine after ‘serious GDPR violation’

Holland’s data regulator fined Uber €290 million this week following what it described as a “serious violation” of General Data Protection Regulation (GDPR) by the taxi riding platform.

The move came after the Dutch Data Protection Authority (DPA) discovered that Uber had failed to safeguard the personal information of European taxi drivers when it transferred data to its headquarters in the US.

The authority found that Uber collected data including account details, taxi licences, location data, photos payment details, identity documents, and in some cases criminal and medical data of drivers, retaining the information on servers based in the States.

For a period of more than two years, the transportation giant transferred data of this kind to the US without using transfer tools. This meant that the protection of personal data was not sufficient.

It is the third fine the Dutch data watchdog has imposed on Uber, with the company facing a penalty of €10 million last year and €600,000 in 2018.

Uber, which National Technology News has reached out to for comment, has since ended its data rules breach.

The company however has indicated to the Dutch DPA its intent to object to the penalty.

“In Europe, the GDPR protects the fundamental rights of people, by requiring businesses and governments to handle personal data with due care”, said Dutch DPA chairman Aleid Wolfsen. “But sadly, this is not self-evident outside Europe.

“Think of governments that can tap data on a large scale. That is why businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union. Uber did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US. That is very serious.”

The Dutch DPA launched an investigation into Uber after over 170 French drivers complained to the French human rights interest group the Ligue des droits de l’Homme (LDH), which subsequently submitted a complaint to the French DPA.

All DPAs in Europe calculate the amount of fines for businesses in the same manner, amounting to a maximum of four per cent of the worldwide annual turnover of a business.

Uber had a worldwide turnover of around €34.5 billion in 2023.