Uber has announced its intention to appeal the fine. The Dutch authority, which oversees Uber’s data protection in the EU, launched its probe following complaints by more than 170 drivers to a French human-rights organization that then alerted the French data protection authority.
The investigation found that after the invalidation of the Privacy Shield by the European Court of Justice, Uber failed to take reasonable protection measures for transferring data. While model contracts and binding corporate rules still were good legal means of transferring data, as of August 2021 Uber had not used either way of its crucial advantages anymore. So the data was unguarded.
The fine is the largest of a series of penalties issued by the regulator to Uber. In 2018, the company was fined €600,000 for not immediately reporting a data breach, while in 2023 it was hit with a separate €10 million fine for lack of transparency about data storage and privacy rights.
The Dutch government has previously targeted major tech companies such as TikTok and Google for privacy and data protection issues.
