Ride-hailing giant Uber has been fined €290 million ($324 million) in the Netherlands for transferring European taxi drivers’ personal data to the United States, breaching European Union (EU) data protection regulations, the Dutch Data Protection Authority (DPA) announced on Monday.
The DPA stated that Uber’s practice of sending personal data to the U.S. failed to adequately safeguard drivers’ information, constituting a serious violation of the General Data Protection Regulation (GDPR). The watchdog noted that Uber has since ceased this data transfer practice.
“This flawed decision and extraordinary fine are completely unjustified,” said Uber spokesperson Caspar Nixon in an email to Reuters. “Uber’s cross-border data transfer process was compliant with GDPR during a three-year period of immense uncertainty between the EU and U.S.” He added that the company intends to appeal the decision and is confident that “common sense will prevail.”
The fine stems from an investigation initiated after a French human rights organization filed a complaint on behalf of over 170 taxi drivers in France with the country’s data protection authority. Since Uber’s European headquarters are located in the Netherlands, the complaint was forwarded to the DPA for further action. The French national data protection regulator, CNIL, cooperated with the DPA during the investigation.
Uber has the option to appeal the DPA’s decision. If the initial appeal is unsuccessful, the company can escalate the case to the Dutch courts. The appeals process is expected to take approximately four years, and any fines are suspended until all legal avenues have been exhausted, according to the DPA.
This is not the first time Uber has faced penalties from the DPA. In January, the company was fined €10 million for infringing privacy regulations concerning its drivers’ personal data.
Reference(s):
Uber fined in Netherlands for sending drivers' data to the U.S.
cgtn.com
