Dutch Regulator’s 290 Million Euro Uber GDPR Fine Still Sits on Appeal After an 825 Million Follow-On Penalty
The €290 million transfer fine was supposed to be the shock. Two years later the same Dutch authority added €825 million for letting software cut drivers off.
The Autoriteit Persoonsgegevens fined Uber Technologies Inc. and Uber B.V. €290 million on August 26, 2024, for sending European Economic Area driver data to the United States for about twenty-seven months without the safeguards Article 44 of the GDPR requires. It was the AP’s largest penalty at the time. Uber said it would appeal. Dutch process can run for years, and administrative fines are typically frozen while an appeal is live. The AEGIS Alliance is rewriting the file because that number is no longer the last Dutch line on Uber. On August 17, 2026, the same regulator issued a separate €824.99 million penalty — about $966 million — over automated driver deactivations. Uber said it would appeal that one too.
What the 2024 Transfer Case Was Actually About
This was not a breach story. No one alleged a teenager dumped a driver table on a forum. The AP said Uber kept piping European driver data to U.S. systems after the Court of Justice of the European Union tore up Privacy Shield in the Schrems II judgment of July 2020. For a stretch of roughly twenty-seven months, the regulator argued, the company lacked the contractual and technical wrapping Article 44 demands for extra-EEA transfers. A replacement framework, the EU-U.S. Data Privacy Framework, landed in July 2023. The Dutch decision treated the gap before Uber’s paperwork caught up as a high-severity infringement.
The European Data Protection Board posted the original announcement. Driver data is not a marketing email. It includes identity documents, location traces, payment details, and the kind of account history that can decide whether a person works next week. Moving that stack to U.S. servers puts it inside a legal system European courts have already called inadequate without extra measures. Uber’s defense has been that it used other tools, that the fine ignores later compliance, and that the number is out of scale. An appeal is the place those arguments belong. It is not a finding that the AP invented the transfer.
This was not Uber’s first Dutch bill. The AP fined the company €600,000 in 2018 and €10 million in 2023. The 2024 transfer case made those look like warnings. GDPR caps most of these penalties at 4 percent of global annual turnover. That formula is why a ride-hail platform with a U.S. parent keeps drawing nine-figure notices from a medium-sized member state. Amsterdam is the European headquarters. The AP is the lead supervisor. The drivers live in every capital.
The 2026 Deactivation Fine Changes the Scale
On August 21, 2026, the AP published the follow-on decision dated August 17. It fined Uber €824,990,000 for deactivating driver accounts through automated systems without, the regulator said, adequate information and human review. Reuters, which reviewed the decision, called it the second-largest GDPR fine on record. The AP’s own notice said Uber’s global turnover was about €44.5 billion in 2025 and that this was the fourth AP fine against the company. Uber “disputes some facts and the size of the fine” and filed an appeal.
Automated deactivation is the labor version of a privacy case. A driver who loses an account overnight loses income without a hearing that looks like a hearing. GDPR’s rules on automated decisions were written for banks and insurers. They fit gig platforms uncomfortably well. If software can lock a person out of work, the person is supposed to know the logic exists and have a route to a human. The AP says Uber’s route was not good enough. Uber says the portrait is wrong and the multiplier is punitive. Both things can be argued. Neither thing makes the €290 million file obsolete. It makes it chapter one.
Stack the two live appeals and the company is staring at more than €1.1 billion in Dutch privacy paper, none of it paid while the courts work. That is the part corporate statements skip. A posted fine is not a wire. It is a claim. Claims this large still move behavior. Product lawyers start attending deactivation meetings. Transfer maps get redrawn even when the general counsel swears the last map was fine.
Why Drivers Are the Recurring Subject
Passenger data gets the slogans. Driver data gets the fines. That pattern is not an accident. Drivers are a workforce that Europe can see. They have unions, lawsuits, and account histories that look like employment files even when the contract says they are not employees. Transferring those files to the United States raises surveillance questions European courts already answered in Schrems II. Automating their shutdown raises fairness questions the same regulation already wrote down in Articles 22 and 13. Uber keeps walking into both doors because the platform is the workplace.
The AEGIS Alliance has tracked other European attempts to put a human on the hook for a platform’s design, including the French indictment of Telegram founder Pavel Durov. Criminal custody and an administrative fine are not the same tool. They are the same instinct. If the product harms people at scale, find a legal handle on the company that ships it. Related labor and tech files live under Tech News, International News, and Business.
Readers who treat the 2024 headline as settled law are early. Readers who treat the 2026 headline as a replacement are sloppy. They are two theories on two fact patterns sharing a defendant and a supervisor. One is about geography of data. The other is about geography of work. Both will take years. Both will be cited in the next platform fight even if a Dutch court later cuts the numbers.
What an Appeal Actually Does
Dutch administrative appeals do not work like a press cycle. The fine pauses. The legal findings do not vanish. Other data-protection authorities read the AP’s reasoning and borrow it. Drivers’ counsel read it and attach it to labor claims. Uber’s investors read it and ask why a compliance story that was supposed to end with the Data Privacy Framework produced a second nine-figure notice. The honest status as of this rewrite is simple. The €290 million transfer penalty is still on appeal. The €824.99 million deactivation penalty is on appeal. No public judgment has erased either one.
Companies that only watched the 2024 transfer fight learned the wrong lesson if they thought a new trans-Atlantic framework would end European risk. Frameworks cover some transfers. They do not cover a driver who cannot get a person on the phone after an app shuts the account. The AP has now written both lessons on Uber’s file. The courts will decide the price. The record already shows the theory.
