Ride-hailing app, Uber was on Monday, slammed a fine of 290 million euros, approximately $324 million by the Dutch Data Protection Authority for transferring the personal data of European drivers to U.S. servers.
According to AFP, the the transfers “seriously violated” the European Union’s General Data Protection Regulation as they failed to appropriately protect driver information.
In a statement by Dutch Data Protection Authority chairman, Aleid Wolfsen, “Uber did not meet the requirements of the GDPR to ensure the level of protection to the data concerning transfers to the US. That is very serious.”
Uber, the DPA added, collected sensitive information of European drivers, including taxi licences, location data, photos, payment details, identity documents, “and in some cases even criminal and medical data of drivers”.
Over two years, the DPA said, the information was transferred to Uber’s US headquarters without using transfer tools.
“Because of this, the protection of personal data was not sufficient,” the DPA said.
Uber said it would appeal the fine.
“This flawed decision and extraordinary fine are completely unjustified,” an Uber spokesperson said in a statement
“Uber’s cross-border data transfer process was compliant with GDPR during 3 years of immense uncertainty between the EU and the US. We will appeal and remain confident that common sense will prevail,” the statement said.
