Uber moved EU driver data to the US for two years with no safeguards — a €290M GDPR fine

On 26 August 2024 the Dutch data protection authority (Autoriteit Persoonsgegevens) fined Uber €290 million ($324M) for transferring European drivers' personal data to the United States without any GDPR-approved transfer mechanism. The Dutch regulator had jurisdiction because Uber's EU headquarters sits in the Netherlands.

The violation ran for more than two years, from August 2021 until late 2023: Uber stopped using Standard Contractual Clauses and adopted no successor until the EU–US Data Privacy Framework became available. The data in transit included account details, taxi licences, location records, photos, payment details, identity documents — and in some cases criminal and medical records.

The case began with more than 170 French drivers complaining through the human rights group Ligue des droits de l'Homme. Uber called the fine unjustified and said it would appeal, arguing that cross-border transfer rules were in flux during that period. It was the Dutch DPA's third fine of Uber, after €600,000 in 2018 and €10M in 2023.