Uber Fined $324 Million for EU Driver Data Leak: Key Takeaways

Uber has been fined €290 million (about $324 million USD) by Dutch data protection authorities for violating the EU General Data Protection Regulation (GDPR). The penalty is related to the transfer of drivers' personal data from the EU to the US, where Uber's headquarters are located. GDPR allows for fines up to 4% of global annual turnover for non-compliance.

Despite Uber's annual revenue of around €34.5 billion in 2023, this fine, while substantial, is notably lower than the maximum possible penalty. It is, however, one of the largest fines imposed on a tech company since GDPR came into effect in 2018. The fine follows complaints from over 170 Uber drivers in France in 2021. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens or AP), responsible for GDPR enforcement in the EU, began the investigation after these complaints were transferred from the French human rights organization Ligue des droits de l'Homme (LDH).

Earlier in January, Uber was fined €10 million for similar issues, but the new fine overshadows this amount significantly. It highlights the seriousness of the breach, as driver data, including account details, taxi licenses, location data, and even criminal and health information, was transferred to the US without adequate protection.

This fine reflects the inadequate data protection during a period of legal uncertainty between the EU and US, following the invalidation of the Privacy Shield agreement in July 2020 and the adoption of a new agreement only in July 2023. Uber claims it adhered to GDPR requirements during this uncertain period but AP argues that the company failed to meet GDPR standards.

Uber plans to appeal the fine, asserting that it is unjustified and erroneous, and that its cross-border data transfer processes complied with GDPR during the legal uncertainty. The company also claims that AP did not provide clear guidance on how to improve processes during this time. Uber believes it has been compliant with GDPR since the beginning of the previous year, having started using the new data transfer framework.