Uber has to pay €290 million to the Dutch Data Protection Authority for transferring European driver data to US servers.
Uber has been fined in the Netherlands 290 million euros for transferring personal data of European drivers to the US. The Dutch Data Protection Authority (DPA) found that Uber collected “sensitive information” about your European driverssuch as taxi licenses, location data and even medical data, and kept it on US servers.
Uber made the transfers to its US databases without “adequately safeguarding the data in connection with those transfers,” the authority noted. The DPA considers this transfer a “serious violation” of the General Data Protection Regulation (GDPR) European.
These laws require “companies and governments to handle personal data with due care,” said Aleid Wolsen, president of the DPA, in a statement on your website. “Unfortunately, this is not evident outside Europe. Think about governments that can intervene data on a large scale.”
“Totally unjustified” fine
“This wrong decision and this extraordinary fine are completely unjustified,” an Uber spokesperson told Euronews Next in an email. Uber maintains that complied with GDPR during three years of “immense uncertainty” between the US and the EU on how the regulations would be applied.
The problem, according to Uber, dates back to 2020, when the EU Court of Justice determined that the current data transfer framework between the EU and the US no longer complied with the regulation. The companies stayed “no clear guidelines for transatlantic data flows” for almost three years, according to a statement supporting Uber from the Computer and Communications Industry Association (CCIA Europe).
The European Commission resolved the situation in July 2023, issuing a statement stating that the US offers enough protection for European data. When the ruling was handed down, Uber said it did not have to make any changes to the way it stores information in the US.
“Any retroactive fines from data protection authorities are particularly worrying given that these same privacy watchdogs have failed to provide useful guidance during this period of great legal uncertaintyin the absence of a clear legal framework,” Alexandre Roure, Head of Policy at CCIA Europe, said by email.
For this European association, retroactive fines mean that there will be legal uncertainty for everything that happens online between 2020 and 2023, from video conferencing to online payment processing. Uber said it will appeal the fine and “continue to trust that common sense will prevail.” Your appeal means that the sanction is suspended until a final decision is made.
Third fine to Uber in five years
The DPA began its investigation earlier this year, after 170 French drivers will complain before the French NGO ‘Ligue des droits de l’Homme’ (Human Rights League) in 2021.
Uber’s headquarters for Europe, the Middle East and Africa is in Amsterdam, so the DPA took over the case. The Dutch authorities They also fined Uber 10 million euros in December and with 600,000 euros in 2018.
The DPA found in its December 2023 investigation that Uber did not respond quickly enough to requests for data from its drivers. Uber also provided “incomplete” information in your privacy statement about how the company transferred data to the US, according to France’s data authority, which worked with the Dutch on the case.
“This decision reaffirms the importance of demanding transparent information and the need to guarantee that the rights of interested parties are respected,” declared then the French data authority in a statement.
Jerome Giusti, a lawyer for the French League for Human Rights, said in a statement in February that it believes the December complaint was “the first large-scale worker action in Europe based on the GDPR.” And he added that the drivers he represents “are considering starting a group action to obtain compensationafter this first condemnatory decision before the French courts”.
Uber maintains that the DPA said that the platform The ride-sharing company fulfilled its obligations to deliver data in a timely manner to its drivers. The company added that its appeal in the December 2023 case remains active.
