Uber fined $324M over EU drivers' data transfer breach

Natasha Lomas
Updated ·5 min read

Ride-hailing platform Uber has been fined €290 million -- around $324 million at current exchanges rates -- by the Netherlands' privacy watchdog for breaching the European Union's General Data Protection Regulation (GDPR).

The penalty is related to transfers of personal data of drivers out of the European Union to the U.S., where Uber's main business is located. The GDPR allows for fines of up to 4% of global annual turnover to be levied for non-compliance.

Uber's full-year revenue for 2023 was around €34.5 billion — so the level of sanction is well below that maximum. However, it is still a notable amount as it's among the largest penalties levied on a tech company since the GDPR began operating back in 2018.

The fine is the outcome of a series of complaints made by more than 170 Uber drivers in France back in 2021. The Dutch regulator, the Autoriteit Persoonsgegevens (or AP), leads on GDPR oversight of Uber as the company has its main EU establishment in the country. It investigated complaints over how the company processes the drivers' personal data. Complaints were submitted through a human rights organization, Ligue des droits de l’Homme (LDH), to France's privacy watchdog and then passed to the AP.

In January, Uber was fined €10 million for data access rights pertaining to the same complaints. But the new fine announced Monday dwarfs the earlier penalty -- landing it a new spot on the list of tech giants stung with the 10 biggest GDPR fines, just below mid-table.

The size of the penalty reflects the seriousness of the breach, per the AP, which wrote in a press release that Uber had failed to "appropriately safeguard" data which it transferred out of the EU -- dubbing that "a serious violation."

The data safeguarding problem relates to U.S. national security intelligence agency surveillance programs which -- in the wake of the 2013 disclosures by NSA whistleblower Edward Snowden -- courts in Europe have repeatedly found to pose a risk to the data protection and privacy rights of EU people. This is an issue because GDPR protections are supposed to travel with Europeans' data.

U.S. tech giants, which are responsible for driving much of the EU-U.S. data flows, have essentially been caught in the middle of this clash for years. Business models that rely on data mining (and therefore access to personal data in the clear) are also particularly exposed to the privacy legal risk.

"In Europe, the GDPR protects the fundamental rights of people, by requiring businesses and governments to handle personal data with due care. But sadly, this is not self-evident outside Europe," wrote Dutch DPA chairman Aleid Wolfsen in a statement. "Think of governments that can tap data on a large scale. That is why businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union. Uber did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US. That is very serious."

The complaints against Uber were made during a period when there was no high-level data transfer framework agreed between the EU and the U.S. In July 2020 the bloc's top court struck down a mechanism known as Privacy Shield that the company, and thousands of others, had been relying on for authorizing their data exports.

A new EU-U.S. data transfer deal was not agreed on and adopted until July 2023 -- meaning there was a period of three years with high legal uncertainty around data exports.

Digital companies have been particularly exposed over this period, given the data-driven nature of their businesses. And Uber is not the only tech giant to have been stung: Meta was hit with a record-breaking GDPR penalty of €1.2 billion back in May 2023 over the same core issue. Several DPAs also warned against use of Google Analytics.

In Uber's case the Dutch DPA said the data it collected and exported included "sensitive" driver information, including account details, taxi licenses, location data, photos, payment details, identity documents and. in some cases. even criminal and medical data of drivers.

"For a period of over 2 years, Uber transferred those data to Uber's headquarters in the US, without using transfer tools. Because of this, the protection of personal data was not sufficient," it wrote.

Uber is not happy about the penalty. It denies any non-compliance and has vowed to file an appeal against the enforcement in court.

Uber spokesman Caspar Nixon emailed TechCrunch a statement in which the company writes: “This flawed decision and extraordinary fine are completely unjustified. Uber’s cross-border data transfer process was compliant with GDPR during a 3-year period of immense uncertainty between the EU and US. We will appeal and remain confident that common sense will prevail.”

The company claims it sought guidance from the AP during the period where there was no high-level EU-U.S. data transfer deal, but says the regulator did not provide it with any clarity that there were problems with its processes.

The AP suggests Uber has been in compliance since the end of last year when it started to use the successor to Privacy Shield. Uber claims the processes that are now considered compliant under this new data transfer framework are the same ones it used before. So, basically, its argument is that the legal goalposts have moved.

However, during the period when there was no high-level EU-U.S. transfer deal, the bloc's privacy regulators warned companies they were responsible for ensuring any data exports complied with the rules.

European Data Protection Board guidance from this period provided information on additional measures the data supervisor said companies may need to apply to raise the level of protection on data exports to ensure their data flows were GDPR compliant -- such as switching to data localization or applying forms of "zero access" encryption that mean exported data cannot be accessed.

Uber's spokesman could not immediately confirm whether it applied any such additional measures during the period.

Latest Stories

  • This Kijiji seller quoted our undercover reporter $25K for a fake job meant for foreign workers

    Investigative Journalism Foundation reporter Apurva Bhat covertly contacted several online advertisers selling job offers to immigrants for cash. In one call, the seller tells her she could get a job offer for a role that doesn’t exist — but only if she pays $25,000.

  • What to know about Europe's tariffs on Chinese electric vehicles

    FRANKFURT, Germany (AP) — The European Union has finalized its sharply higher customs duties on electric vehicles imported from China. EVs are the latest flash point in a broader trade dispute over Chinese government subsidies and Beijing's burgeoning exports of green technology to the 27-nation bloc.

  • Nearly two-thirds of Canadians worry about running out of money in retirement: CPP survey

    The concern over outliving your retirement plan is even higher among younger Canadians and women.

  • Huawei gears up for launch of new flagship smartphone model Mate 70 next month: source

    Huawei Technologies is expected to launch its new flagship smartphone Mate 70 next month, as a resurgence in its premium handset business intensifies its rivalry with Apple and major Chinese competitors, according to local media reports and a supply chain source familiar with the matter. If confirmed, the launch will offer fresh evidence that the Shenzhen-based tech giant, which briefly overtook Samsung Electronics and Apple in global smartphone shipments before it was hit by US sanctions, is re

  • Explainer-What happens as EU concludes investigation of Chinese-made EVs?

    The European Union formally approved imposing tariffs on Chinese-made electric vehicles (EVs) on Tuesday after an investigation that has divided the bloc and prompted retaliation from Beijing. The European Commission has set rates ranging from 7.8% for Tesla to 35.3% for China's SAIC and other producers deemed not to have cooperated with the EU's anti-subsidy probe. The EU also published its regulation imposing final or "definitive" tariffs in the EU's Official Journal on Tuesday.

  • Polestar says Biden proposal would 'effectively prohibit' sale of its cars in US

    WASHINGTON (Reuters) -Polestar said on Monday that a proposed Biden administration rule to bar the use of Chinese vehicle hardware and software would "effectively prohibit" the automaker from selling vehicles in the United States, including cars made in the U.S. The Swedish automaker, a brand of Volvo Cars that is majority-owned by China's Geely, said in comments filed with the Commerce Department that a proposed rule prohibiting Chinese connected vehicles on American roads due to national security concerns would bar the sale of vehicles that Polestar is building in South Carolina as well as those produced in China.

  • Crude Oil: Geopolitical Risks, OPEC+ Discord May Spark Potential Plunge Below $67

    Crude oil traders brace for potential volatility amid geopolitical tensions and OPEC+ disagreements. Key support and resistance levels may guide near-term trading strategies amid shifting supply risks. Staying nimble could prove essential as fresh headlines from the Middle East and OPEC+ loom large. Looking for actionable trade ideas to navigate the current market volatility? Unlock access to InvestingPro’s AI-selected stock winners for under $9 a month! Crude oil prices are caught in a whirlwin

  • The EU will impose duties on electric vehicle imports from China from Thursday

    BRUSSELS (AP) — The European Union will impose duties on imports of electric vehicles from China from Thursday, after talks between Brussels and Beijing failed to find an amicable solution to their trade dispute, EU spokesman Olof Gill said.

  • Chinese cities dominate Amazon seller network, outnumbering US hubs, report says

    China is home to US e-commerce giant Amazon.com's four biggest merchant bases, according to new research, showing the significant role that the world's second-largest economy continues to play in the global supply chain despite geopolitical tensions. Shenzhen, a technology and factory hub in China's southern Guangdong province, leads the pack with 102,588 sellers registered on Amazon, collectively generating US$35.3 billion revenue annually, according to US e-commerce service provider Smartscout

  • China-EU trade war erupts as Beijing files WTO complaint over EV tariff hikes

    A trade war between China and the European Union was set to intensify after Beijing said it had lodged a complaint with the World Trade Organization following a move by the European Union to hike tariffs on Chinese-made electric vehicles. China's commerce ministry on Wednesday said in a statement that it "does not agree with or accept" the EU's decision to proceed with extra duties on the EVs after the conclusion of an anti-subsidy probe that began last year. A final ruling published by the Euro

  • LinkedIn has unveiled a new AI agent and AI job coaching tool. Here's how to boost your CV for AI

    AI is changing the way we work, but also how we get the jobs.View on euronews

  • Over 25% of Google’s code is now written by AI—and CEO Sundar Pichai says it’s just the start

    Demand for AI offerings from Alphabet's cloud business helped drive an impressive revenue and earnings beat.

  • China eager to resolve EU's 'divide and conquer' tactics during EV talks: analysts

    China is anxious to fend off the European Union's "divide and conquer" tactics during their electric vehicle (EV) tariff negotiations to maintain a united front and steer future talks, analysts said. Chinese EV manufacturers should, they added, also not be influenced as the EU insists on the right to approach firms individually. China and the EU have said that headway has been made, with both sides set to continue exchanges next month, focusing on price commitments. Do you have questions about t

  • EU to go ahead with tariffs on Chinese EVs after failure in talks

    The European Union will impose duties on Chinese-made electric vehicles this week, after talks with Beijing failed to reach a deal that would have halted their passage. In a final ruling published on Tuesday, the European Commission confirmed that a top rate of 35.3 per cent would be applied to EVs from the state-owned company SAIC Motor and its subsidiaries, on top of a baseline 10 per cent duty that applies to all EV imports. The ruling is expected to be written into EU law by Wednesday, the f

  • The EU is imposing duties on electric vehicles from China after trade talks fail

    BRUSSELS (AP) — The European Union is imposing duties on imports of electric vehicles from China starting Wednesday after talks between Brussels and Beijing failed to find an amicable solution to their trade dispute.

  • Volkswagen stumbles in China as Germany's auto giants struggle to compete in the EV race

    Volkswagen is mulling the closure of factories in Germany for the first time to cut costs, while rivals BMW and Mercedes-Benz face their own problems.

  • ASML Holding N.V. (ASML) Faces Challenges Amid Semiconductor Short Positions

    We recently published a list of Jefferies’ Top Crowded Semiconductor Short Positions: Top 10 Stocks. In this article, we are going to take a look at where ASML Holding N.V. (NASDAQ:ASML) stands against other Jefferies’ top crowded semiconductor short positions’ stocks. With the third quarter earnings season with us, the semiconductor industry continues to be […]

  • Halifax Alehouse must close for 45 days due to incidents including patron's death

    A downtown Halifax bar at the centre of a criminal case and civil lawsuits is now the subject of one of the longest closures ever issued to a liquor licensee in the province.The Halifax Alehouse must shut its doors for 45 consecutive days as a penalty stemming from charges under the Liquor Control Act following a death and alleged assault outside the bar in 2022."It is a significant penalty," Roland Deveau, panel chairman for the Nova Scotia Utility and Review Board, said at a hearing Tuesday. D

  • Oil rises on US stockpiles drawdown, OPEC+ mulls output hike delay

    NEW YORK (Reuters) -Oil prices rebounded on Wednesday, rising more than 2% after data showed U.S. crude and gasoline inventories fell unexpectedly last week and on reports that OPEC+ may delay a planned oil output increase. After falling more than 6% earlier in the week on the reduced risk of wider Middle East war, Brent crude futures settled up $1.43, or 2.01%, at $72.55 a barrel. U.S. gasoline stockpiles fell unexpectedly last week to a two-year low on strengthened demand, the Energy Information Administration said, while crude inventories also posted a surprise drawdown as imports slipped.

  • Starbucks abandons the olive oil coffee that was the brainchild of its former CEO

    Starbucks is eliminating its controversial olive oil-infused drinks from the menu, less than a year after they made their nationwide debut.