The Dutch data protection watchdog said Monday it hit ride-hailing app Uber with a 290-million-euro ($324 million) fine over the transfer of personal data of European drivers to US servers.
The regulator said the transfers were a “serious violation” of the European Union’s General Data Protection Regulation (GDPR), as they failed to appropriately protect driver information.
“Uber did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US. That is very serious,” Dutch Data Protection Authority (DPA) chairman Aleid Wolfsen said in a statement.
The DPA said Uber collected sensitive information of European drivers, including taxi licences, location data, photos, payment details, identity documents, “and in some cases even criminal and medical data of drivers”.
Over a two-year period, the DPA said, the information was transferred to Uber’s US headquarters without using transfer tools.
“Because of this, the protection of personal data was not sufficient,” the DPA said.
Uber said it would appeal the fine.
“This flawed decision and extraordinary fine are completely unjustified,” an Uber spokesperson said in a statement
“Uber’s cross-border data transfer process was compliant with GDPR during a 3-year period of immense uncertainty between the EU and US. We will appeal and remain confident that common sense will prevail,” the statement said.
The EU has rolled out a series of rules for big tech firms and imposed huge fines for breaches in recent years.
The DPA said it started the investigation after more than 170 French drivers complained to a French human rights interest group, which then filed a complaint to France’s data protection watchdog.
Under the GDPR, a business that processes data in several EU countries must deal with the data protection authority where its main office is located. Uber’s European headquarters are in the Netherlands.
“In Europe, the GDPR protects the fundamental rights of people, by requiring businesses and governments to handle personal data with due care,” Wolfsen said.
“But sadly, this is not self-evident outside Europe,” he said,
“Think of governments that can tap data on a large scale. That is why businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union.”
It is the DPA’s third fine against Uber following fines of 600,000 euros in 2018 and 10 million euros last year.
