Uber Fined EUR 290M for Transferring Driver Data to US
The Dutch Data Protection Authority imposed a EUR 290 million fine on Uber in August 2024 for transferring European driver personal data to the United States for over two years without a valid transfer mechanism under GDPR Chapter V. Following the Schrems II invalidation of the EU-US Privacy Shield in July 2020, Uber continued transferring sensitive driver data--including identity documents, location data, and criminal records--after dropping Standard Contractual Clauses in August 2021 and relying on a joint controller agreement without any valid GDPR Chapter V transfer mechanism.
Executive Summary
KEY FACTS
- WhatUber transferred EU driver data to the US without valid GDPR mechanisms.
- WhoAll EEA Uber drivers over a two-year period post-Schrems II.
- Data ExposedIdentity documents, GPS location data, criminal records, and financials.
- OutcomeDutch DPA fined Uber EUR 290M; appeal filed by Uber.
References
SOURCES
Dutch DPA Decision, CJEU Schrems II ruling, GDPR Chapter V, EDPB Recommendations 01/2020