Uber Hit with Record €290 Million Fine for Data Privacy Breach

Uber Hit with Record €290 Million Fine for Data Privacy Breach

2024-08-27 data

Netherlands, Tuesday, 27 August 2024.
The Dutch Data Protection Authority has imposed a €290 million fine on Uber for unsafe transmission of European drivers’ personal data to the United States. This unprecedented penalty, the largest privacy fine in Dutch history, stems from Uber’s failure to adequately protect sensitive information, including identity documents and payment details, transferred to its U.S. headquarters.

Scope of the Breach

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) identified significant lapses in Uber’s handling of data. The company transferred sensitive information such as account details, taxi licenses, location data, photos, payment details, identity documents, and in some instances, criminal and medical records of drivers to its U.S. headquarters without employing sufficient safeguards. This was a clear violation of the General Data Protection Regulation (GDPR), which mandates stringent protective measures for data transferred outside the European Union.

Origins of the Investigation

The investigation was initiated following complaints from over 170 French drivers, lodged through the Ligue des droits de l’Homme (LDH) to the French data protection authority. The French authority then collaborated with the Dutch AP, given that Uber’s European headquarters is located in the Netherlands. The AP’s investigation revealed that Uber had not used any valid transfer mechanisms such as Standard Contractual Clauses (SCCs) from August 2021, compromising the data protection of EU drivers.

The GDPR, enacted in 2018, is a comprehensive regulation that aims to protect the personal data and privacy of individuals within the European Union. It requires businesses to implement robust security measures when transferring data outside the EU. The regulation allows for fines up to 4% of a company’s global annual revenue for violations. In Uber’s case, the €290 million fine represents a significant penalty, underscoring the gravity of their non-compliance. Uber’s global revenue in 2023 was approximately €34.5 billion, making this fine a substantial financial setback.

Uber’s Response and Future Measures

Uber has labeled the fine as ‘unjustified’ and announced its intent to appeal the decision. The company argues that it has since adopted the successor framework to the Privacy Shield, which was invalidated by the EU Court of Justice in 2020 due to concerns over potential U.S. government surveillance. Despite this, the Dutch AP maintains that Uber did not meet GDPR requirements for ensuring data protection during the transition period. Uber will continue to face scrutiny as it navigates the appeal process, which could extend over several years.

Broader Impact on Data Privacy

This case highlights the importance of robust data protection mechanisms, particularly in an era where cross-border data transfers are commonplace. The fine serves as a stark reminder to multinational companies of the stringent requirements of the GDPR and the serious consequences of non-compliance. Aleid Wolfsen, chairman of the Dutch AP, emphasized the need for businesses to handle personal data with utmost care to uphold fundamental rights protected by European law.

Bronnen


mtsprout.nl www.nytimes.com www.cbsnews.com Uber privacy fine autoriteitpersoonsgegevens.nl www.autoriteitpersoonsgegevens.nl www.edpb.europa.eu