Dutch watchdog fines Uber $324M for unsafe transfer of driver data to U.S.

Aug. 26 (UPI) -- The Dutch Data Protection Authority on Monday fined ridesharing app Uber $324 million for transferring the personal data of its European drivers in the United States without proper protections.

The DPA accused Uber of a "very serious" violation of collecting sensitive information on drivers in Europe and keeping them on servers in the United States without using transfer tools that would protect the data.

"In Europe, the [General Data Protection Regulation] protects the fundamental rights of people, by requiring businesses and governments to handle personal data with due care," Aleid Wolfsen, the Dutch DPA chairman, said in a statement. "But sadly, this is not self-evident outside Europe.

The DPA said Uber collected data, including account details and taxi licenses, as well as more personal information such as location data, photos, payment details and identity documents over a period of more than two years and transferred the data from Europe to Uber's U.S.-based headquarters.

It added that criminal and mecidal records were also stored and transferred in some instances.

"Think of governments that can tap data on a large scale. That is why businesses are usually obligated to take additional measures if they store the personal data of Europeans outside the European Union," Wolfsen said. "Uber did not meet the requirements of the GDPR to ensure the level of protection to the data concerning transfers to the United States."

The investigation was launched after The Human Rights League of France filed a complaint to the French DPA on behalf of more than 170 French drivers.

The Dutch DPA said Uber would appeal the fine.

"Uber's cross-border data transfer process was compliant with the GDPR during a 3-year period of immense uncertainty between the EU and U.S., " an Uber spokesperson told the BBC . "The flawed decision and extraordinary fine are completely unjustified."

The authority said this marks the third time the DPA fined Uber and the largest. The DPA fined Uber $670,485 in 2018 and $11.17 million in 2023.