The Dutch Data Protection Authority (DPA) has imposed a €290 million fine on Uber for transferring European taxi drivers’ personal data to the United States (US) without adequate protection.The breach was deemed a serious violation of the General Data Protection Regulation (GDPR).Background of the CaseThe investigation began after over 170 French Uber drivers lodged complaints with the Ligue des droits de l’Homme (LDH), a French human rights organization.The LDH then submitted these complaints to the French Data Protection Authority. The French DPA forwarded the complaints to the Dutch DPA, which is the Lead Supervisory Authority for Uber due to its European headquarters being based in the Netherlands.Key FindingsThe Dutch DPA found that Uber collected sensitive information from European drivers and stored it on servers in the US. This data included:Account details,Taxi licenses,Location information,Photos,Payment details,Identity documents,and, in some cases, criminal and medical data.Uber transferred this data to its US headquarters for over two years without using adequate transfer safeguards. This lack of protection became particularly problematic following the Court of Justice of the EU’s invalidation of the EU-US Privacy Shield in 2020.The Court ruled that Standard Contractual Clauses (SCCs) could still be used for data transfers if they ensured equivalent protection.However, Uber stopped using SCCs in August 2021, leading to insufficient protection of EU drivers’ data. Uber has since adopted the successor to the Privacy Shield.Regulatory ResponseAleid Wolfsen, chairman of the Dutch DPA, stated that Uber’s failure to meet these GDPR requirements is a serious matter, and commented, that GDPR is designed to protect individuals’ data within Europe, requiring businesses and governments to handle this data with the utmost care.Unfortunately, this level of protection is not always guaranteed outside Europe. Businesses must implement additional measures when storing European data outside the EU.Fines and ComplianceIn 2023, Uber’s worldwide turnover was approximately €34.5 billion. Uber has indicated its intention to contest this fine.This is the third fine imposed on Uber by the Dutch DPA. Previous fines included €600,000 in 2018 and €10 million in 2023, with Uber currently contesting the latter.