The Dutch Knowledge Safety Authority (Autoriteit Persoonsgegevens, AP) has imposed a high-quality of €290,000,000 ($325 million) on Uber Applied sciences Inc. and Uber B.V. over GDPR violations.
The authority accuses Uber of transferring private knowledge from the European Financial Space (EEA) to servers in the USA with out satisfactory safeguards, as outlined by Chapter V of the Normal Knowledge Safety Regulation.
That is the third time the Dutch Knowledge Safety Authority has imposed an administrative high-quality on Uber.
The primary was a €600,000 high-quality for poor knowledge entry controls in November 2018. The second was a €10,000,000 high-quality imposed in January 2024 for Uber’s obscure knowledge administration practices concerning the dealing with of information from EU topics.
AP’s investigation into Uber’s knowledge practices was triggered by complaints from French drivers and escalated to the AP by the French knowledge safety authority (CNIL).
The difficulty arose after the Schrems II ruling by the Courtroom of Justice of the European Union invalidated the EU-U.S. Privateness Defend as a consequence of inadequate knowledge safety requirements within the US.
Regardless of the ruling, Uber allegedly continued to switch private knowledge to the US with out implementing Normal Contractual Clauses (SCCs), or different safeguards, thus violating GDPR Article 44, which mandates that knowledge transfers to 3rd international locations should guarantee an equal stage of safety as inside the EU.
This is identical violation for which the Irish Knowledge Safety Fee (DPC) imposed a large $1.3 billion high-quality on Meta (Fb). Extra not too long ago, 4 companies have been fined $1.1 million by the Swedish Authority for Privateness Safety (IMY) for related violations prompted by way of Google Analytics.
Uber’s response
Uber argued that Chapter V of the GDPR didn’t apply as a result of Article 3 of the GDPR already prolonged the regulation’s safety to their processing actions within the US.
Moreover, the tech agency contends that no knowledge switch happens, as outlined below GDPR, since drivers present their knowledge on to Uber’s US-based servers by the app.
The AP rejected these arguments and proceeded to impose the huge. Extra particulars about AP’s investigation and last determination will be discovered within the supporting doc.
Responding to our request for a remark, an Uber spokesperson instructed BleepingComputer that they discover the ruling unjustified and plan to enchantment the choice.
“This flawed determination and extraordinary high-quality are utterly unjustified. Uber’s cross-border knowledge switch course of was compliant with GDPR throughout a 3-year interval of immense uncertainty between the EU and US. We’ll enchantment and stay assured that widespread sense will prevail.” – Uber spokesperson
Uber maintains that its knowledge dealing with practices, as these are specified by its privateness discover, adhere to GDPR. As well as, it sees knowledge flows between customers in addition to customers and Uber as a basic and inherent part of its providers.
The enchantment course of can take as much as 4 years, throughout which the high-quality might be suspended.