The Dutch data protection authority, the Autoriteit Persoonsgegevens, has fined Uber €290 million for transferring European drivers’ personal data to the United States for more than two years without adequate safeguards.
Key points
- Sensitive data, including identity documents, was transferred.
- Uber had stopped using standard contractual clauses.
- The investigation followed complaints from French drivers.
- The Dutch authority acted as lead supervisory authority.
The fine is a reminder that transfer mechanisms need continuous attention. UK organisations transferring personal data internationally should check that their mechanisms remain valid, documented and supported by transfer risk assessments.
Source: Uber €290 million fine (Autoriteit Persoonsgegevens)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
