³ÉÈËÓ°Òô

Legal News

Uber fined €290m for unauthorised data transfers to the US

Published on: 16 September 2024

Table of contents

  • Background to the Dutch DPA’s investigation
  • What processing was at issue?
  • How does the fine compare with other fines issued under Chapter V of the EU GDPR?
  • Key takeaways for practitioners

Article summary

EU Law analysis: Over the summer, the Data Protection Authority (DPA) in the Netherlands (the Autoriteit Persoonsgegevens or AP), imposed a fine of €290m on Uber. The AP issued the fine in respect of transfers of personal data of Uber drivers from the EU to Uber’s headquarters in the US over a period of more than two years for retention on Uber servers in the US. The AP found that Uber had carried out these transfers without implementing appropriate safeguards as required by Chapter V of Regulation (EU) 2016/679, the EU General Data Protection Regulation (EU GDPR). The personal data involved included sensitive information of the Uber drivers such as location data, identity documents, and in some cases criminal and medical data. Dr. Paul Voigt, partner and Wiebke Reuter, senior associate, at Taylor Wessing Germany, consider the implications.

Popular documents