Enforcement
290 million euro fine for Uber over transfers of driver data to the US
- Date
- Status
- under appeal
- Body
- Autoriteit Persoonsgegevens
- Reference
- AP-besluit tot oplegging bestuurlijke boete aan Uber Technologies Inc. en Uber B.V., 22 juli 2024 (kenmerk vertrouwelijk), gepubliceerd 26 augustus 2024
- Amount
- €290,000,000
What it is about
From 6 August 2021 to 27 November 2023 Uber transferred European drivers' data to its US headquarters without a transfer tool. The data included account data, taxi licences, location data, photos, payment data, ID documents and sometimes criminal and medical data. Uber stopped using standard contractual clauses in August 2021. According to the Dutch DPA this breaches Article 44 GDPR. The 290 million euro fine is based on a 2023 global turnover of about 34.5 billion euros. Uber has been certified under the EU US Data Privacy Framework since 27 November 2023. Uber announced an objection; according to the DPA press release of 21 August 2026 Uber is still contesting the fine and the procedure is ongoing.
What this means in practice
Every transfer outside the EEA needs a tool: adequacy decision, standard contractual clauses with supplementary measures or another Chapter V mechanism. Dropping SCCs without a replacement is itself a breach, even if the data later fall under the Data Privacy Framework. The fine is calculated on the group's worldwide turnover.
The GDPR articles concerned
Source: Autoriteit Persoonsgegevens, persbericht en boetebesluitchecked on 15 September 2026
Summary and practical reading by Praxikon. Not legal advice; the source prevails.
Connections
What connects to this development
Case law
- Schrems II: Privacy Shield invalid, transfers under standard clauses only with essentially equivalent protection
2020-07-16 · final, Hof van Justitie van de EU (Grote kamer), Data Protection Commissioner tegen Facebook Ireland Ltd en Maximillian Schrems
Guidelines
- Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR
2023-02-14 · final, European Data Protection Board (EDPB)
- Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data
2021-06-18 · final, European Data Protection Board (EDPB)
Enforcement and fines
- 100 million euro fine for MLU B.V. (Yango) for transfers to Russia
2026-04-01 · status not established, Autoriteit Persoonsgegevens