Skip to main content
Praxikon

Enforcement

10 million euro fine for Uber over unclear retention and transfer information, objection rejected

Date
Status
under appeal
Body
Autoriteit Persoonsgegevens
Reference
Boetebesluit 11 december 2023 (gepubliceerd 31 januari 2024); besluit op bezwaar 3 maart 2026 (gepubliceerd 8 mei 2026); kenmerken in gepubliceerde versie zwartgelakt
Amount
€10,000,000

What it is about

The Dutch DPA fined Uber Technologies Inc. and Uber B.V. a total of 10 million euro in two fines, following complaints by more than 170 French drivers via the Ligue des droits de l'homme. Uber's privacy notice did not clearly state retention periods, the non EEA countries data were transferred to, or the right to data portability. Uber also made the right of access unnecessarily hard: the access form was buried in the driver app, data were supplied in a CSV file without explanation of its structure, and the accompanying guidance notes were only available in English. The DPA found breaches of Article 12(1) and (2) and Article 13(1)(f) and (2)(a) and (b) GDPR. On 3 March 2026 the DPA rejected Uber's objection and upheld the fine. According to the DPA, Uber is appealing to the court.

What this means in practice

Your privacy notice must state concretely how long you keep data, to which non EEA countries you transfer them and which safeguards apply. The access request form must be easy to find, and data supplied in response must be structured and understandable, in plain language suited to the audience. An English only explanation is not enough when many data subjects have limited command of English.

The GDPR articles concerned

Source: Autoriteit Persoonsgegevens, besluit op bezwaar boete Uberchecked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law

Guidelines

Enforcement and fines