Uber Fined €290 Million by Dutch Regulator for GDPR Violations in Data Transfers to U.S.
Uber was hit with a record €290 million (about $324 million) fine by the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) for transferring the private data of European drivers to the United States in violation of EU data protection law. It is the largest penalty the Dutch regulator has ever issued.
According to the DPA, Uber failed to adequately protect the personal information of European taxi drivers when it moved that data to the United States, an action the watchdog called a “serious” violation of the General Data Protection Regulation (GDPR). The company has since ended the practice.
The regulator found that Uber gathered and stored sensitive driver information on servers in the United States for more than two years. That data included account details, taxi licenses, location data, photos, payment details, and identity documents — and, in some cases, even the drivers’ criminal and medical records.
At the heart of the case is the way Uber moved that data across the Atlantic. After the Court of Justice of the EU invalidated the EU-US Privacy Shield in 2020, companies could still rely on Standard Contractual Clauses (SCCs) to transfer data abroad, but only where an equivalent level of protection could be guaranteed in practice. The DPA determined that Uber stopped using SCCs from August 2021, leaving EU drivers’ data insufficiently protected. The regulator pinpointed the unlawful transfers to a roughly 27-month window between August 6, 2021, and late November 2023, the point at which Uber joined the list under the EU-US Data Privacy Framework, the successor arrangement that took effect in July 2023.
Uber called the fine “completely unjustified” and said it would challenge the ruling, telling Bloomberg that its cross-border data transfer process complied with the GDPR. The company has since lodged a formal objection, and the matter remains contested.
The investigation did not begin in the Netherlands. It was triggered by a collective complaint from the French human rights group Ligue des droits de l’Homme (LDH), filed on behalf of more than 170 French Uber drivers, which the French regulator CNIL forwarded to its Dutch counterpart. Because Uber’s European headquarters sits in the Netherlands, the Dutch DPA acted as lead supervisory authority and coordinated the decision with other European regulators. The case treated Uber B.V. in Amsterdam and Uber Technologies Inc. in San Francisco as joint controllers of the drivers’ data.
This was not Uber’s first run-in with the Dutch regulator. The €290 million penalty was the third the DPA has imposed on the company, following a €600,000 fine in 2018 and a €10 million fine in December 2023. In announcing that earlier penalty, the DPA said Uber had made it unnecessarily difficult for drivers to exercise their right to view or obtain copies of their personal data, and had failed to clearly disclose in its privacy terms how long it retained driver data or what safeguards it applied when sending information outside the European Economic Area. Uber objected to that fine as well.
Under the GDPR, penalties can reach up to 4% of a company’s worldwide annual turnover, and regulators across the EU calculate them using a shared method. With Uber’s 2023 global turnover at roughly €34.5 billion, the €290 million figure sat well within that ceiling, and the DPA rejected Uber’s challenge to how the amount was calculated. Even so, the fine is dwarfed by the €1.2 billion penalty Ireland’s regulator imposed on Meta in 2023, still the largest GDPR fine to date.
U.S. companies have long drawn scrutiny from European data protection authorities over transatlantic transfers, amid concerns that American surveillance programs could reach the personal data of EU residents. In 2022, regulators in France and Austria concluded that the transatlantic transfer of Google Analytics data ran afoul of the GDPR. The Uber decision, however, has proved contentious among legal observers, who note that it appears to depart from European Data Protection Board guidance on whether a foreign firm collecting data directly from EU residents must also apply the GDPR’s transfer safeguards — a tension that may ultimately require the Court of Justice of the EU to settle.
“Think of governments that can tap data on a large scale. That is why businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union,” said Aleid Wolfsen, chairman of the DPA, underscoring why the regulator treats overseas storage of Europeans’ personal data as a matter demanding extra safeguards.
