The Dutch Data Protection Authority has fined Uber Technologies $324 million (€290 million) for infringing European data privacy policy. When transferring personal information of European drivers to the United States, the company violated regulations on how to protect data. This is the largest fine ever imposed by that watchdog arm.

Uber's fine was levied for failing to comply with the European Union's (EU) General Data Protection Regulation (GDPR). The data protection authority in the Netherlands also discovered that sensitive data was not adequately protected when European drivers transferred it to their U.S. headquarters after the EU-U.S. Privacy Shield was invalidated in 2020. By relying on this arrangement, drivers' information was left exposed and unprotected throughout nearly three years of operations.

Chairman Aleid Wolfsen of the Dutch regulator noted sternly: There is an enormous violation here, because according to the GDPR there should be special protection for personal data and required safe guards against disclosure to outside Europe. Later in 2023 Uber began using a revised set, which it called the EU-USA Data Privacy Framework.

Uber has announced its intention to appeal the fine. The Dutch authority, which oversees Uber's data protection in the EU, launched its probe following complaints by more than 170 drivers to a French human-rights organization that then alerted the French data protection authority.

The investigation found that after the invalidation of the Privacy Shield by the European Court of Justice, Uber failed to take reasonable protection measures for transferring data. While model contracts and binding corporate rules still were good legal means of transferring data, as of August 2021 Uber had not used either way of its crucial advantages anymore. So the data was unguarded.

The fine is the largest of a series of penalties issued by the regulator to Uber. In 2018, the company was fined €600,000 for not immediately reporting a data breach, while in 2023 it was hit with a separate €10 million fine for lack of transparency about data storage and privacy rights.

The Dutch government has previously targeted major tech companies such as TikTok and Google for privacy and data protection issues.