Uber hit with €10 million fine by Dutch data protection authority

In a move highlighting the importance of data privacy rights within the European Union, the Dutch Data Protection Authority (AP) has levied a hefty €10 million fine against Uber Technologies, Inc. and Uber B.V.

The sanction comes in response to Uber's failure to transparently disclose its data retention periods for European drivers' data and the non-European countries to which this data is transferred. Furthermore, the AP criticised Uber for hindering drivers' attempts to exercise their privacy rights effectively.

AP chairman Aleid Wolfsen: “Drivers have the right to know how Uber handles their personal data. However, Uber did not explain this with sufficient clarity. It should have informed its drivers better and more diligently in this regard. Transparency is a fundamental part of protecting personal data. If you don’t know how your personal data is being handled, you can’t determine whether you are being put at a disadvantage or treated unfairly. And you can’t stand up for your rights.”

The investigation by the AP revealed that Uber complicated the process for drivers wishing to access or receive copies of their personal data. Despite the availability of a form within the driver app designed for this purpose, its placement within various app menus made it challenging for drivers to locate, suggesting that it could have been positioned more intuitively.

A critical aspect of the AP's findings highlighted Uber's lack of clarity in its privacy terms and conditions. The company failed to specify the duration for which it retains drivers' personal data. Additionally, there was a notable absence of information regarding the specific security measures Uber employs when transferring this data to entities outside the European Economic Area (EEA), raising concerns about the safeguarding of sensitive information.

Wolfsen added: “This shows that Uber put all sorts of obstacles in place that blocked drivers from exercising their right to privacy, and that is prohibited. In fact, Uber should be facilitating drivers in their rights. This is laid down by law.”