Netherlands data protection authority fines Uber €290M for violating EU data regulation News
freestocks-photos / Pixabay
Netherlands data protection authority fines Uber €290M for violating EU data regulation

The Data Protection Agency (DPA) of the Netherlands fined Uber 290 million euros on Monday for violating the EU General Data Protection Regulation (GDPR) by storing the personal data of European taxi drivers on US servers.

The DPA found that Uber did not sufficiently protect the personal data that it transferred to the US. Uber sent personal data from the EU to its headquarters in the US for two years without the use of transfer tools to protect the data. Transfer tools include encryption and pseudonymisation, and should be used when sending personal data outside of the EU, according to the DPA.

Businesses in Europe are permitted to transfer data outside of the EU through a Standard Contractual Clause, which is a model contract approved by the European Commission. Nonetheless, businesses that store personal data outside the EU typically have to utilize additional measures, such as transfer tools, to ensure that EU data protection standards are met.

Special rules apply to data transfers to the US. American businesses that participate in the Data Privacy Framework are treated as having a level of data protection that is equivalent to that of the EU, according to an adequacy decision of the European Commission from 2023. EU citizens may submit a complaint regarding how their personal data is handled, even if the business is a member of the Data Privacy Framework.

The investigation by Dutch authorities was triggered by a complaint from 170 taxi drivers in France. Since Uber’s European headquarters are in the Netherlands, the Dutch DPA was responsible for the investigation.

The data that was transferred included “location data, photos, payment details, identity documents, and in some cases even criminal and medical data of drivers”. The GDPR establishes the protection of personal data as a fundamental right in the EU.

Uber has indicated its intent to appeal the fine, according to the DPA.

THIS DAY @ LAW

Justice Department brings anit-trust action against AT&T

On November 20, 1974, the Department of Justice filed its final anti-trust suit against AT&T. United States v. AT&T was ultimately settled out of court with an agreement that the corporation would break up its monopoly on phone service throughout the country.

Nuremberg war crimes trials began

On November 20, 1945, the war crimes trials of Nazi World War II leaders began in the German city of Nuremberg. Review the Nuremberg Tribunal's Charter and the verdicts and sentences handed down on major war figures.

Winston Churchill born

On November 20, 1874, Sir Winston Churchill was born in Woodstock, England. He would go on to lead the United Kingdom as Prime Minister through World War II. Toward the end of the war, Churchill worked with US President Franklin D. Roosevelt to craft the treaties and accords that have defined the world since WWII. A 2002 poll by the BBC declared Churchill the Greatest Briton of all time.

New Jersey ratifies Bill of Rights

New Jersey ratified the Bill of Rights, a set of 10 fundamental amendments to the US Constitution, on November 20, 1789, becoming the first state to do so. The state also ratified an amendment on federal representation which ultimately failed. Additionally, New Jersey rejected an amendment on congressional salaries, which would eventually become the 27th Amendment more than 200 years later. Read the articles ratified by New Jersey.