Uber slapped with a €290 million fine

Uber hit with record $324 million fine by Dutch DPA

Uber, the popular rideshare company, has been slapped with its largest fine ever by the Dutch Data Protection Authority (DPA). The hefty €290 million penalty ($324 million) was imposed after the DPA found that Uber had transferred personal data of European taxi drivers to the United States without adequate protection measures in place. This incident, which originated from a complaint in France, ultimately landed in Holland due to the location of Uber’s EU headquarters.

Transfer of sensitive data without proper safeguards

An investigation by the Dutch DPA revealed that Uber had been transferring a wealth of sensitive information, including account details, taxi licenses, location data, photos, payment details, and identity documents, to servers at their US headquarters for over two years. Shockingly, during this period, Uber neglected to utilize any transfer tools, leaving the data vulnerable to potential breaches. Dutch DPA chairman Aleid Wolfsen emphasized the severity of the situation, stating that Uber had failed to meet the GDPR requirements for ensuring the protection of data during transfers to the US.

History of fines and legal battles

This is not the first time Uber has been fined by the Dutch DPA. In 2018, the company received a €600,000 penalty for failing to promptly report a data breach that occurred two years earlier. Then, in 2023, Uber was fined €10 million for inadequate disclosure of data retention periods and sharing practices involving non-European countries. Despite objections from Uber, the company now faces a significant legal battle as it contests the €290 million fine imposed by the Dutch regulatory body.