Dutch Data Protection Authority Imposes €290 Million Uber Fine Over US Data Transfers

What the authority found

According to the Dutch authority, Uber collected sensitive information about drivers in Europe, including account details and taxi licences, location data, photos, payment details and identity documents, and in some cases criminal and medical data. For more than two years, Uber transferred this data to its US headquarters and stored it on US servers without using a transfer tool.

The authority said Uber stopped using Standard Contractual Clauses from August 2021, leaving the data of EU drivers insufficiently protected. Uber has used the successor to the EU-US Privacy Shield since the end of 2023.

The legal background

The Court of Justice of the EU invalidated the Privacy Shield in its July 2020 judgment in Schrems II. The Court held that Standard Contractual Clauses could remain a valid basis for transfers, but only where an equivalent level of protection is guaranteed in practice. The Dutch authority concluded that this was not the case for Uber's driver data.

How the case started

The investigation began after more than 170 French Uber drivers complained to the French human rights organisation Ligue des droits de l'Homme, which filed a complaint with the French supervisory authority. Because Uber's European headquarters are in the Netherlands, the complaint was passed to the Dutch authority as lead supervisor. All other EU and EEA authorities were concerned authorities in the procedure except those of Bulgaria, Cyprus, Iceland, Latvia, Liechtenstein, Luxembourg and Slovenia.

Why it matters

The fine underlines that companies moving personal data out of the European Economic Area must rely on a valid transfer mechanism at every point, including during periods when adequacy arrangements change. Multinationals with centralised HR, payment or operational data in the United States may wish to review the transfer basis used in each period.

Sources

• European Data Protection Board: Dutch SA imposes a fine of 290 million euro on Uber because of transfers of drivers' data to the US
• Court of Justice of the EU: Press Release No 91/20, Judgment in Case C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems