Uber fined €290 million for 'very serious' GDPR violation

Transport giant Uber has been fined €290 million ($323 million) for failing to protect the data of its European drivers under the General Data Protection Regulation (GDPR).

The Dutch Data Protection Authority (DPA) imposed the massive fine after finding that Uber transferred and stored the personal data of European taxi drivers to the United States without appropriately safeguarding it.

According to the Dutch DPA, Uber transferred sensitive information to its US headquarters without using transfer tools, resulting in insufficient protection for the personal data transferred.

"Uber did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US. That is very serious," said Dutch DPA chairman Aleid Wolfsen in a statement.

Sensitive data collected

Among the data collected by Uber is driver information, such as account details and taxi licences, location data, photos, payment details, identity documents, and criminal and medical data of drivers.

"In Europe, the GDPR protects the fundamental rights of people, by requiring businesses and governments to handle personal data with due care," Wolfsen said.

"But sadly, this is not self-evident outside Europe. Think of governments that can tap data on a large scale. That is why businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union."

Uber called the ruling "flawed" and said it would appeal the fine, BBC News reported.

"Uber's cross-border data transfer process was compliant with GDPR during a three-year period of immense uncertainty between the EU and US," an Uber spokesperson said as quoted by the news outlet. "This flawed decision and extraordinary fine are completely unjustified."

This is third time that the Dutch DPA fined Uber. The transport company was also fined €600,000 ($670,166) in 2018 and another €10 million ($11.1 million) in 2023.