Uber fined €290 million by Dutch regulators

The ride-hailing service Uber has been fined €290 million ($323.8 million) by Dutch regulators for allegedly failing to provide adequate data protection when transferring driver details between Europe and the US.

The data included account details, taxi licences, photos, payment details, identity documents, and in some cases criminal and medical records of drivers.

Uber said the decision by the regulators was flawed and it would appeal.

The Dutch Data Protection Authority said the data transfers, which happened over two years, amounted to a serious breach of the European Union’s General Data Protection Regulation (GDPR), which requires companies to take measures to protect user data.

“In Europe, the GDPR protects the fundamental rights of people, by requiring businesses and governments to handle personal data with due care,” Dutch DPA chairman Aleid Wolfsen said in a statement.

“But sadly, this is not self-evident outside Europe. Think of governments that can tap data on a large scale. That is why businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union.

“Uber did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US. That is very serious.”

'Completely unjustified'

Uber said the fine was “completely unjustified”.

“Uber’s cross-border data transfer process was compliant with GDPR during a three-year period of immense uncertainty between the EU and US,” the company said.

“We will appeal and remain confident that common sense will prevail,” it added.

The case was started by complaints from 170 French Uber drivers, but it fell to the Dutch authority to issue the fine because Uber’s European headquarters is in the Netherlands.

The alleged breach of the rules followed a ruling by the EU in 2020 regrading an agreement called Privacy Shield, which allowed thousands of companies to transfer data to the US. Privacy Shield was ruled as invalid because the US government maintained the ability to access people’s data.

As such, the Dutch agency said the EU ruling meant standard clauses in contracts could provide a basis for transferring data outside the EU, “but only if an equivalent level of protection can be guaranteed in practice”.

“Because Uber no longer used standard contractual clauses from August 2021, the data of drivers from the EU were insufficiently protected,” the watchdog said. It added that the alleged rule breach came to an end last year, because Uber started using the successor to Privacy Shield.

But tech sector advocacy said the Dutch agencies actions ignored the reality of doing day-to-day business on the ground following the Privacy Shield ruling.

“The busiest internet route in the world could not simply be put on hold for three entire years while governments worked to establish a new legal framework for these data flows,” said Alexandre Roure, European head of policy at the Computer and Communications Industry Association.

“Any retroactive fines by data protection authorities are especially worrisome given that these very privacy watchdogs failed to provide helpful guidance during this period of significant legal uncertainty, in absence of any clear legal framework.”

This is not the first time Uber and the Dutch authorities have crossed swords over this issue.

In January, the Dutch data protection regulator fined Uber €10 million over what it said was the company's failure to disclose how long it retained data from drivers in Europe or which “specific security measures” it takes when sending driver information to countries outside the European Economic Area.