Den nederlandske tilsynsmyndigheds 290 millioner EUR Uber GDPR bøde sidder stadig på appel efter en 825 millioner følger-på straf

EUR 290 millioner overførsel bøde skulle være chokket. To år senere tilføjede den samme nederlandske myndighed 825 mio. EUR til at lade software afbryde chaufførerne.

The Autoriteit Persoonsgegevens fined Uber Technologies Inc. and Uber B.V. €290 million on August 26, 2024, for sending European Economic Area driver data to the United States for about twenty-seven months without the safeguards Article 44 of the GDPR requires. It was the AP’s largest penalty at the time. Uber said it would appeal. Dutch process can run for years, and administrative fines are typically frozen while an appeal is live. AEGIS Alliance er at omskrive filen, fordi dette nummer ikke længere er den sidste hollandske linje på Uber. Den 17. august 2026, den samme regulator udstedt en separat €824,99 millioner straf - omkring $966 millioner - over automatiserede driver deaktiveringer. Uber sagde, at det også ville appellere den.

Hvad var 2024-sagen egentlig om?

This was not a breach story. No one alleged a teenager dumped a driver table on a forum. The AP said Uber kept piping European driver data to U.S. systems after the Court of Justice of the European Union tore up Privacy Shield in the Schrems II judgment of July 2020. For a stretch of roughly twenty-seven months, the regulator argued, the company lacked the contractual and technical wrapping Article 44 demands for extra-EEA transfers. A replacement framework, the EU-U.S. Data Privacy Framework, landed in July 2023. The Dutch decision treated the gap before Uber’s paperwork caught up as a high-severity infringement.

EU Det Europæiske Databeskyttelsesråd posted the original announcement. Driver data is not a marketing email. It includes identity documents, location traces, payment details, and the kind of account history that can decide whether a person works next week. Moving that stack to U.S. servers puts it inside a legal system European courts have already called inadequate without extra measures. Uber’s defense has been that it used other tools, that the fine ignores later compliance, and that the number is out of scale. An appeal is the place those arguments belong. It is not a finding that the AP invented the transfer.

This was not Uber’s first Dutch bill. The AP fined the company €600,000 in 2018 and €10 million in 2023. The 2024 transfer case made those look like warnings. GDPR caps most of these penalties at 4 percent of global annual turnover. That formula is why a ride-hail platform with a U.S. parent keeps drawing nine-figure notices from a medium-sized member state. Amsterdam is the European headquarters. The AP is the lead supervisor. The drivers live in every capital.

2026 deaktivering bøde ændrer skalaen

Den 21. august 2026 offentliggjorde AP følgende beslutning af 17. august. Det bøde Uber €824,990.000 for at deaktivere driverkonti gennem automatiserede systemer uden, sagde regulatoren, tilstrækkelig information og menneskelig gennemgang. Reuters, som gennemgik beslutningen, kaldte den den den næststørste GDPR-bøde. AP 's egen meddelelse sagde Uber globale omsætning var omkring €44,5 milliarder i 2025, og at dette var den fjerde AP bøde mod virksomheden. Uber "anfægter nogle fakta og størrelsen af bøden" og indgivet en klage.

Automated deactivation is the labor version of a privacy case. A driver who loses an account overnight loses income without a hearing that looks like a hearing. GDPR’s rules on automated decisions were written for banks and insurers. They fit gig platforms uncomfortably well. If software can lock a person out of work, the person is supposed to know the logic exists and have a route to a human. The AP says Uber’s route was not good enough. Uber says the portrait is wrong and the multiplier is punitive. Both things can be argued. Neither thing makes the €290 million file obsolete. It makes it chapter one.

Stack the two live appeals and the company is staring at more than €1.1 billion in Dutch privacy paper, none of it paid while the courts work. That is the part corporate statements skip. A posted fine is not a wire. It is a claim. Claims this large still move behavior. Product lawyers start attending deactivation meetings. Transfer maps get redrawn even when the general counsel swears the last map was fine.

Hvorfor chauffører er det tilbagevendende emne

Passenger data gets the slogans. Driver data gets the fines. That pattern is not an accident. Drivers are a workforce that Europe can see. They have unions, lawsuits, and account histories that look like employment files even when the contract says they are not employees. Transferring those files to the United States raises surveillance questions European courts already answered in Schrems II. Automating their shutdown raises fairness questions the same regulation already wrote down in Articles 22 and 13. Uber keeps walking into both doors because the platform is the workplace.

AEGIS Alliance har sporet andre europæiske forsøg på at sætte et menneske på krogen til en platforms design, herunder Fransk tiltale af telegram grundlægger Pavel DurovStrafferetlig varetægt og en administrativ bøde er ikke det samme værktøj. De er det samme instinkt. Hvis produktet skader folk i skala, finde et juridisk håndtag på det selskab, der sender det. Relaterede arbejdskraft og tech filer lever under Tech News, Internationale nyheder, og Virksomhed.

Readers who treat the 2024 headline as settled law are early. Readers who treat the 2026 headline as a replacement are sloppy. They are two theories on two fact patterns sharing a defendant and a supervisor. One is about geography of data. The other is about geography of work. Both will take years. Both will be cited in the next platform fight even if a Dutch court later cuts the numbers.

Hvad en appel faktisk gør

Dutch administrative appeals do not work like a press cycle. The fine pauses. The legal findings do not vanish. Other data-protection authorities read the AP’s reasoning and borrow it. Drivers’ counsel read it and attach it to labor claims. Uber’s investors read it and ask why a compliance story that was supposed to end with the Data Privacy Framework produced a second nine-figure notice. The honest status as of this rewrite is simple. The €290 million transfer penalty is still on appeal. The €824.99 million deactivation penalty is on appeal. No public judgment has erased either one.

Companies that only watched the 2024 transfer fight learned the wrong lesson if they thought a new trans-Atlantic framework would end European risk. Frameworks cover some transfers. They do not cover a driver who cannot get a person on the phone after an app shuts the account. The AP has now written both lessons on Uber’s file. The courts will decide the price. The record already shows the theory.