The Dutch knowledge coverage authority (DPA) has hit Uber with a €290mn high quality for moving non-public Ecu driving force knowledge to the USA.
Consistent with the DPA, the transfers constituted a “severe violation” of the EU’s GDPR, as they did not give you the essential safeguards for knowledge garage outdoor the block.
Following an investigation, the DPA discovered that, between August 2021 and November 2023, Uber used to be moving and storing delicate knowledge to US servers with out the extra coverage equipment required through the GDPR.
The information integrated taxi licences, account and cost main points, IDs, pictures, or even prison or clinical information.
“In Europe, the GDPR protects other folks’s elementary rights through requiring firms and governments to care for non-public knowledge with care,” stated DPA chairman Aleid Wolfsen.
Alternatively, Uber failed to make sure this stage of coverage, he added.
The investigation used to be triggered through a criticism from over 170 French drivers to native human rights organisation Ligue des droits de l’Homme (LDH). LDH then filed a criticism to France’s knowledge coverage watchdog CNIL.
Consistent with the GDPR, firms processing knowledge around the EU should resolution to a unmarried privateness authority, positioned within the nation the place a industry has its Ecu headquarters. As Uber’s base is within the Netherlands, the DPA led the probe.
The DPA stated that Uber has now stopped the apply. It’s additionally going to enchantment the verdict.
That is the 3rd high quality the Dutch watchdog imposes on Uber. In 2018, the DPA hit the corporate with €600,000 for failing to inform the company on time over an information breach in 2016. And as of January this yr, Uber could also be going through a €10mn high quality (once more) for violating privateness laws, which it has appealed.
