Uber has been fined €290 million in the Netherlands for transferring drivers’ personal data to the US. The Dutch Data Protection Authority (DPA) found that Uber collected information about its European drivers, such as taxi licenses, location data and even medical data, and stored it on US servers.

“However, when information is transferred to databases in the United States, adequate protection is not ensured,” the DPA added.

The DPA considers such transfers to be a “serious breach” of the European General Data Protection Regulation (GDPR).

“These data protection laws require businesses and governments to handle personal data with due care, – stated Aleid Wolsen, Chairperson of the DPA, in statement on your website. – But unfortunately, this is not obvious outside of Europe. Think about governments that can eavesdrop on data on a large scale.”

UBER: “The fine is completely unjustified”

“This erroneous decision and the extreme fine are completely unjustified,” “An Uber spokesperson said in an email to Euronews Next.

Uber says it is complying with GDPR amid three years of “massive uncertainty” between the US and EU over how the rules will be enforced.

According to Uber, the problem arose back in 2020, when the EU court ruled that the current system of data transfers between the EU and the US no longer complies with the GDPR.

“European and US companies have been left without clear guidelines on transatlantic data flows for almost three years,” – the Computer and Communications Industry Association (CCIA Europe) said in a statement in support of Uber.

The European Commission resolved the situation in July 2023, issuing a statement that the United States provides adequate protection for European data.

Uber said it did not have to make any changes to the way it stores information in the U.S. after the ruling.

“Any retroactive fines from data protection authorities are particularly worrying given that these same privacy authorities have failed to provide useful guidance at a time of significant legal uncertainty, in the absence of any clear legal framework,” “Alexander Ruhr, head of policy for the CCIA’s European office, said in an emailed statement.

The CCIA says retroactive fines mean legal uncertainty for everything that happens online between 2020 and 2023, from video conferencing to online payment processing.

Uber said it would appeal the fine and expressed confidence that common sense would prevail. The appeal means the fine is suspended until a final decision is made.

Uber’s third fine in five years

The DPA launched its investigation earlier this year after 170 French drivers filed a complaint with the French NGO Ligue des droits de l’Homme (Human Rights League) in 2021.

Uber’s headquarters for Europe, the Middle East and Africa are in Amsterdam, so the DPA took up the case. Dutch authorities also fined Uber €10 million last December and €600,000 in 2018.

In an investigation conducted in December 2023, the DPA found that Uber had not responded quickly enough to data requests from its drivers.

Uber also provided “incomplete” information in its privacy statement about how the company transfers data to the U.S., according to a statement from the French data protection authority, which worked with the Dutch on the matter. business.

“This decision confirms the importance of the requirement for transparent information and the need to ensure that the rights of data subjects are respected,” – it is said in statement French Data Protection Authority.

Jerome Giusti, a lawyer for the French League for Human Rights, in a February statement said he believed the December complaint was the first large-scale worker action in Europe based on the GDPR.

“The drivers I represent are considering initiating a class action lawsuit to obtain compensation following this first ruling in the French courts,” Giusti said.

Euronews Next contacted the French NGO for information about the possible lawsuit but did not receive an immediate response.

In the case, Uber argues that the DPA believes the ride-sharing platform met its obligations to promptly transmit data to its drivers. The company said its appeal in the December 2023 case is still active.