In a significant blow to the ride-hailing giant, Uber has been slapped with a £246m fine by the Dutch Data Protection Authority (DPA) for violating European Union rules on personal data transfer.
According to the DPA, Uber illegally transferred the personal data of European drivers, including account details, taxi licences, location data, photos, payment information, identity documents, and, in some cases, even criminal and medical records, to servers in the United States, flouting EU regulations.
“Uber transferred personal data of European taxi drivers to the United States and failed to appropriately safeguard the data. This constitutes a serious violation of the GDPR,” the DPA said on Monday.
The investigation revealed that Uber had made it excessively difficult for drivers to access their personal data, hindering their right to privacy.
“In Europe, the GDPR protects the fundamental rights of people, by requiring businesses and governments to handle personal data with due care.
“But sadly, this is not self-evident outside Europe. Think of governments that can tap data on a large scale. That is why businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union.
Uber did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US. That is very serious,” Dutch DPA chairman Aleid Wolfsen says.
Furthermore, the company failed to specify the retention period for drivers’ personal data and did not disclose the security measures in place when transferring this data to entities outside the European Economic Area (EEA).
Uber has called the decision ‘flawed’ and will appeal.
“This flawed decision and extraordinary fine are completely unjustified. Uber’s cross-border data transfer process was compliant with General Data Protection Regulation (GDPR) during a 3-year period of immense uncertainty between the European Union and United States. We will appeal and remain confident that common sense will prevail,” Uber spokesman Caspar Nixon told Reuters in an email.
The fine follows a complaint lodged by more than 170 French drivers through the Ligue des droits de l’Homme (LDH) to the French DPA.
Given Uber’s European headquarters in the Netherlands, the Dutch DPA led the investigation, working closely with its French counterpart and coordinating with other European regulators.