Ride sharing giant Uber has been fined 290 million euros (A$478.4 million) in the Netherlands for sending the unprotected personal data of its European drivers to the US.
The fine was imposed by the Dutch Data Protection Authority (DPA) after Uber was found to be transferring personal data without appropriate safeguards, which the organisation has labelled a “serious violation” of European data rules.
While Uber has since ended the violation, Reuters reports it intends to object the fine, with a company spokesperson labelling it a “flawed decision” that was “completely unjustified”.
100s of new car deals are available through CarExpert right now. Get the experts on your side and score a great deal. Browse now.
Dutch DPA chairman Aleid Wolfsen said European data rules existed to protect peoples’ personal data within the region, though Uber had failed to take appropriate precautions to mitigate the lack of such rules overseas.
“[European regulation] protects the fundamental rights of people, by requiring businesses and governments to handle personal data with due care,” Mr Wolfsen said, reports Reuters.
“But sadly, this is not self-evident outside Europe. That is why businesses are usually obliged to take additional measures if they store personal data of Europeans outside the European Union.
“Uber did not meet the requirements … to ensure the level of protection to the data with regard to transfers to the US. That is very serious.”
The DPA says it found Uber collected sensitive data from Europe and stored it on servers in the US, such as account details, taxi licences, location data, photos, payment details, identity documents, and in some cases drivers’ criminal and medical data.
For a period of two years, the DPA claims Uber transferred such data to its US headquarters without the necessary tools, resulting in the insufficient protection of personal data.
The investigation was triggered after a complaint on the behalf of more than 170 Uber drivers in France was lodged by a French human rights organisation with the country’s DPA.
As Uber’s European headquarters are located in the Netherlands, the case was forwarded to the Dutch DPA.
Reuters reports Uber can appeal the decision, and if unsuccessful can then file a case with the Dutch courts. The appeals process could take up to four years, and any fines are suspended until “all legal recourses have been exhausted”.
“Uber’s cross-border data transfer process was compliant with [European regulation] during a three-year period of immense uncertainty between the EU and US,” Mr Nixon said.
Uber is reportedly confident that “common sense will prevail”.
