Uber Just Got Hit With A Massive $320 Million Fine Here’s Why

Uber faces a fine of 290 million euros (about $320 million) for violating EU data protection laws.

That’s the basic story, but to understand the details, you first need to know what GDPR is. It’s the General Data Protection Regulation, a policy introduced in the EU in May 2018. While in the US we’re used to playing fast and loose with consumer privacy, the EU has a different approach, and one that has worked well so far.

The GDPR sets out specific provisions that companies must comply with regarding user data, as well as the rights that individuals have regarding their data online.

The Dutch Data Protection Authority (DPA) alleges that Uber collected sensitive information, including location data, photos, payment details and even criminal and medical data, from its drivers and stored it on servers in the US.

The GDPR requires a series of rules that companies must comply with when transferring data outside the European Economic Area, and the DPA says Uber failed to comply with these standards for two years. Because of this oversight, the DPA claims that the protection of personal data was inadequate.

The problems began when more than 170 French Uber drivers complained to the advocacy group Ligue des droits de l’Homme, which then passed the complaints on to the French DPA. Since Uber’s European headquarters are in the Netherlands, the Dutch DPA took over the case.

It is also worth noting that this is the third time the Dutch DPA has imposed fines on Uber. The first fine of €600,000 was imposed in 2018, followed by another fine of €10 million in 2023.

Data transfers must ensure an adequate level of data protection. The European Commission can decide on adequacy on a country-wide basis, appropriate safeguards and/or specific exceptions. In the case of Uber, the Dutch DPA states that these safeguards were not met and that the drivers’ personal information was too vulnerable to attack.

The size of the fine is not arbitrary. All data protection agencies in Europe calculate the size of the fine in the same way, charging a maximum of up to 4% of the company’s global annual turnover.

Uber has since stopped sharing data in this way and changed its practices to comply with GDPR rules. The company said it plans to appeal the fine, calling it “completely unjustified” in a statement given to The Verge by an Uber spokesperson.

So what does this mean for Uber? The company will have to defend its position, but no matter the outcome, Uber is here to stay. It remains the world’s leading ride-sharing service, with a 25% market share, but perhaps this case will lead to better data protection practices in the US and the rest of the world.