The Dutch Data Protection Authority (DPA) has imposed a fine of €290 million on Uber for violating data protection law regarding the privacy of its drivers in Europe.
The Dutch data protection watchdog, in a statement released on Monday, said it found that Uber transferred personal data of European taxi drivers to the United States (US) and failed to appropriately safeguard the data with regard to these transfers.
According to the Dutch DPA, this constitutes a serious violation of the General Data Protection Regulation (GDPR). It, however, noted that Uber has ended the violation.
The latest pronouncement makes it the third time Uber has been sanctioned by the Dutch authority. The DPA imposed a fine of 600,000 euro on Uber in 2018, and a fine of 10 million euro in January 2024. Uber has, however, objected to this last fine.
Data safety outside Europe
Emphasizing the GDPR would continue to protect European citizens by requiring businesses and governments to handle personal data with due care, Dutch DPA chairman Aleid Wolfsen said European data transferred outside the region are not getting the same treatment.
“Think of governments that can tap data on a large scale. That is why businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union.
“Uber did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US. That is very serious,” Wolfsen said.
The DPA Chairman added that the regulator also found that Uber collected, among other things, sensitive information of drivers from Europe and retained it on servers in the US. It concerns account details and taxi licences, but also location data, photos, payment details, identity documents, and in some cases even criminal and medical data of drivers.
The fine
According to the Dutch DPA, the fine on Uber was decided by all data protection authorities in Europe and the amount represents 4% of Uber’s turnover.
“All DPAs in Europe calculate the amount of fines for businesses in the same manner. Those fines amount to a maximum of 4% of the worldwide annual turnover of a business. Uber had a worldwide turnover of around 34.5 billion euro in 2023,” it said.
Basis for data transfer
The DPA noted that according to the Court, Standard Contractual Clauses could still provide a valid basis for transferring data to countries outside the EU, but only if an equivalent level of protection can be guaranteed in practice.
It added that because Uber no longer used Standard Contractual Clauses from August 2021, the data of drivers from the EU were insufficiently protected.
The Dutch DPA started the investigation on Uber after more than 170 French drivers complained to the French human rights interest group the Ligue des droits de l’Homme (LDH), which subsequently submitted a complaint to the French DPA.
Implications for Nigerian businesses
The latest fine against Uber serves as a stark reminder for Nigerian businesses that operate internationally or handle the personal data of European citizens.
The GDPR applies extraterritorially, meaning it can affect businesses outside the EU if they offer goods or services to EU residents or monitor their behavior.
- This also highlights the global imperative for robust data protection practices as DPAs all over the world are now taking bold actions to protect their citizens’ data.
- Just recently, authorities in Nigeria, the Federal Competition and Consumer Protection Commission (FCCPC) and the Nigeria Data Protection Commission (NDPC) also imposed a $220 million fine against Meta Platforms for contravening the Federal Competition and Consumer Protection Act (FCCPA) and the Nigeria Data Protection Regulation (NDPR)
- The final order highlighted Meta’s alleged infringements to include, denying Nigerian data subjects the right to self-determine; unauthorized transfer and sharing of Nigerian data-subjects personal data, including cross-border storage in violation of then, and now prevailing law; discrimination and disparate treatment and abuse of Dominance.