UK (Commonwealth) _ Uber Technologies Inc. has been fined with a colossal amount of $324 million (€290 million) from Dutch regulators for sending European taxi drivers’ personal information to the US in violation of EU data protection laws.
Uber was found to have violated the General Data Protection Regulation (GDPR) on Monday by failing to adequately secure the data it transmitted to the US, according to the Dutch Data Protection Authority (DPA).
Cab permits, IDs, location data, images, payment information, and even criminal and medical histories were among the personal information of European cab drivers that was sent. The agency stated in a statement that Uber “did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US.” “That is extremely grave.”
According to the DPA, the ride-hailing company has subsequently discontinued this practice and put in place the necessary precautions towards the end of last year.
Uber intends to challenge the DPA’s ruling. “This erroneous ruling and exorbitant penalty are wholly unwarranted,” Uber representative Caspar Nixon emailed media outlets.
Uber declared that it will file an appeal against the punishment. “During a three-year period of extreme uncertainty between the EU and the US, Uber’s cross-border data transfer process was compliant with GDPR,” an Uber representative stated. The statement went on, “This erroneous ruling and extraordinary fine are wholly unjustified.”
The transfers, according to the Dutch Data Protection Authority (DPA), were a “serious violation” of the General Data Protection Regulation (GDPR) of the EU because they did not properly secure driver information.
Over a two-year period, the watchdog claims that data, including identification cards, taxi licenses, and location information, was sent to the company’s US headquarters.
Although EU legislation permits data transfers to the US, there is a great deal of confusion regarding the circumstances in which these transfers can take place without further authorization.
The corporation did not comply with GDPR regulations to “ensure the level of protection to the data with regard to transfers to the US,” according to DPA chairman Aleid Wolfsen.
“That is very serious,” he continued, pointing out that Uber had not properly protected the data either.
According to the DPA, Uber obtained private information on drivers in Europe, including driver identities, taxi licenses, location data, images, payment information, and identity documents—”and in some cases even criminal and medical data of drivers”
It said that more than 170 French drivers complained to a French human rights organization, which subsequently submitted a complaint, which then complained to France’s data security watchdog body.
A company that processes data across several EU member states is required by GDPR regulations to engage with the data protection authority in the country where its main office is situated. In the Netherlands is where Uber has its European headquarters.
“In Europe, the GDPR protects the fundamental rights of people, by requiring businesses and governments to handle personal data with due care,” stated Mr. Wolfsen.
He explained, “Businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union.” “Think of governments that can tap data on a large scale,” he continued.
The DPA has now fined Uber three times, for a total of €600,000 (£508,000) in 2018 and €10 million (£8.5 million) in 2017. In recent years, the EU has introduced a number of regulations for large internet companies and levied steep fines for violations.
Irish authorities penalized TikTok €345 million (£296 million) last year for breaking GDPR regulations pertaining to children’s privacy. Uber Technologies, Inc.—also known as Uber—is a transnational transportation firm based in the United States that offers ride-hailing, food delivery, courier services, and freight transportation. With its global headquarters located in San Francisco, California, the company operates in over 70 countries and 10,500 cities. With over 150 million monthly active users and 6 million active drivers and couriers, it is the largest ridesharing firm in the world. Since its launch in 2010, it has facilitated 47 billion travels, or an average of 28 million trips every day. The company’s take rate, or revenue as a proportion of total bookings, was 18.3% for food delivery and 28.7% for mobility services in 2023.
Uber considers its drivers to be independent contractors or gig workers, a classification that has sparked debate and legal concerns as it permits the business to deny its drivers the employment rights that it would otherwise be compelled to offer.
