The Dutch information security authority (DPA) has actually struck Uber with a EUR290mn fine for moving individual European motorist information to the United States.
According to the DPA, the transfers made up a “severe offense” of the EU’s GDPR, as they stopped working to offer the essential safeguards for information storage outside the block.
Following an examination, the DPA discovered that, in between August 2021 and November 2023, Uber was moving and saving delicate information to United States servers without the extra defense tools needed by the GDPR.
The information consisted of taxi licences, account and payment information, IDs, pictures, and even criminal or medical records.
“In Europe, the GDPR safeguards individuals’s essential rights by needing business and federal governments to deal with individual information with care,” stated DPA chairman Aleid Wolfsen.
Uber stopped working to guarantee this level of defense, he included.
The examination was triggered by a grievance from over 170 French chauffeurs to regional human rights organisation Ligue des droits de l’Homme (LDH). LDH then submitted a problem to France’s information defense guard dog CNIL.
According to the GDPR, business processing information throughout the EU should response to a single personal privacy authority, situated in the nation where a company has its European head office. As Uber’s base remains in the Netherlands, the DPA led the probe.
The DPA stated that Uber has actually now stopped the practice. It’s likewise going to appeal the choice.
This is the 3rd fine the Dutch guard dog troubles Uber. In 2018, the DPA struck the business with EUR600,000 for stopping working to alert the company on time over an information breach in 2016. And since January this year, Uber is likewise dealing with a EUR10mn fine (once again) for breaching personal privacy guidelines, which it has actually appealed.
Released August 26, 2024 – 10:16 am UTC
Back to leading ยป …
Learn more