Uber Technologies Inc (NYSE:UBER, ETR:UT8) has been slapped with a $324 million (€290 million) fine by Dutch regulators for transferring the personal data of European taxi drivers to the United States, violating European Union data protection rules.
The Dutch Data Protection Authority (DPA) said on Monday Uber failed to appropriately safeguard the data it transferred to the US, constituting a “serious violation” of the General Data Protection Regulation (GDPR).
The personal data of European taxi drivers transferred included taxi licenses, IDs, location data, photos, payment details and even criminal and medical records.
“Uber did not meet the requirements of the GDPR to ensure the level of protection to the data with regard to transfers to the US,” the regulator said in a statement. “That is very serious.”
The ride-hailing platform has since stopped this practice and late last year implemented the proper safeguards, the DPA said.
Uber plans to appeal the DPA's decision.
"This flawed decision and extraordinary fine are completely unjustified," Uber spokesperson Caspar Nixon told Reuters in an email.
"Uber’s cross-border data transfer process was compliant with GDPR during a three-year period of immense uncertainty between the EU and US.”
The data transfer was investigated following a series of complaints from 170 French Uber drivers back in 2021. The DPA led the investigation because Uber’s European headquarters are in the Netherlands.
Uber shares traded lower on the news, down 2.4% at about $72 on Monday morning.