The Dutch Data Protection Authority (DPA) announced on Monday that it has imposed a substantial fine of 290 million euros ($324 million) on ride-hailing giant Uber for improperly transferring the personal data of European drivers to servers in the United States.
This penalty underscores the severity of the violations against the European Union’s General Data Protection Regulation (GDPR), which is designed to protect the privacy and personal data of individuals within the EU.
According to the DPA, Uber’s data transfers constituted a “serious violation” of the GDPR, as the company failed to ensure adequate protection for the sensitive information of its European drivers during the transfer process.
Aleid Wolfsen, chairman of the Dutch Data Protection Authority, expressed deep concern over the matter, stating, “Uber did not meet the requirements of the GDPR to ensure the necessary level of protection for the data when transferring it to the US. This is a very serious issue.”
The DPA’s investigation revealed that Uber had collected a wide array of sensitive data from its European drivers, including taxi licenses, location data, photographs, payment details, identity documents, and, in some cases, even criminal and medical records.
Over a span of two years, this information was transferred to Uber’s headquarters in the United States without the use of approved data transfer tools or mechanisms, thereby compromising the protection of personal data.
READ ALSO:
Nigeria’s GDP Growth Has Been in Decline Since 2014, Says Okonjo-Iweala
The Dutch watchdog highlighted the significance of these violations, emphasizing that the absence of appropriate safeguards during the transfer process left the personal data of European drivers inadequately protected. “Because of this, the protection of personal data was not sufficient,” the DPA concluded in its statement.
In response to the fine, Uber announced its intention to appeal the decision. A spokesperson for the company described the DPA’s ruling as both flawed and unjustified.
“This flawed decision and extraordinary fine are completely unjustified,” the spokesperson said. The company also defended its data transfer practices, asserting that they were in compliance with GDPR requirements during what they described as a “3-year period of immense uncertainty” between the EU and the US.
Uber expressed confidence that the appeal process would ultimately vindicate their position, with the spokesperson adding, “We will appeal and remain confident that common sense will prevail.”
The outcome of this appeal will be closely watched, as it could have significant implications for the broader issue of cross-border data transfers between the European Union and the United States, particularly in the context of ongoing debates over data privacy and security.