Ride-sharing giant Uber has been fined 290 million euros ($478.4 million) in the Netherlands for sending unprotected personal data of European drivers to the United States.
The Dutch Data Protection Authority (DPA) imposed the fine after finding that Uber transferred personal data without appropriate safeguards, in what it called a “serious breach” of European data rules.
Although Uber has since stopped the offending behavior, Reuters The company reportedly intends to contest the fine, with a company spokesperson calling it a “misguided decision” and “completely unreasonable”.
Hundreds of new car deals are now available through CarExpert. Let the experts help you get a great deal. Browse Now.
European data regulations exist to protect people’s personal data in the region, although Uber has failed to take adequate precautions to mitigate the lack of such regulations abroad, said Dutch DPA President Aleid Wolfsen.
“[European regulation] protect fundamental human rights by requiring businesses and governments to handle personal data with care,” said Mr. Wolfsen, reporting Reuters.
“But sadly, this is not so obvious outside Europe. That is why businesses are often forced to take additional measures if they store Europeans’ personal data outside the European Union.
“Uber has failed to meet the requirements… to ensure the level of data protection in relation to transfers to the United States. That is very serious.”
The DPA said it found Uber had collected sensitive data from Europe and stored it on servers in the United States, such as driver account information, taxi licenses, location data, photos, payment information, identification documents and, in some cases, medical and criminal data.
Over a two-year period, the DPA claims Uber transferred that data to its US headquarters without the necessary tools, resulting in inadequate protection of personal data.
The investigation was launched after a French human rights organization filed a complaint on behalf of more than 170 Uber drivers in France with the country’s DPA.
Since Uber’s European headquarters are in the Netherlands, the case was referred to the Dutch DPA.
Reuters Uber can appeal the decision and, if unsuccessful, take legal action in Dutch courts. The appeals process could take up to four years, and any fines are suspended until “all legal remedies have been exhausted”.
“Uber’s cross-border data transfer procedures comply with [European regulation] during a turbulent three years between the EU and the US,” said Mr. Nixon.
Uber is said to be confident that “common sense will prevail.”
