Uber receives $324 million EU penalties for unlawful data transfer

A bill of €290 million ($347 million) could be waiting on Uber due to improper transfers of EU driver data to the United States, judging by the scale of other fines levied under the European Union's General Data Protection Regulation (GDPR) to date. The Dutch Data Protection Authority imposed the fine to Uber, warning that the personal data of European drivers was not properly protected upon transference to the United States, according to the DPA, which added that Uber has since stopped the practice.

"Uber does not meet requirements from the GDPR to ensure a level of data protection for money transfers in the United States," the watchdog said in a statement. "This is very serious." This included complaints from 170 French Uber drivers, which DPAs say they received from a human rights group who passed them on to the French DPA. The investigation is facilitated by the fact that Uber has its European headquarters in the Netherlands. Uber was revealed to contravene the GDPR by storing its drivers' 'sensitive data' on US servers. 

The data contained details of taxi accounts and licensing, location data, photographs, payment details, identity documents, and in some instances, drivers' criminal and medical records, the DPA found. Group said that Uber had moved the data without the use of tool for migration, ensuring weak data protection. The General Data Protection Regulation is the clause in a 2016 adopted European Union regulation that lays down new rules for the management and sharing of personal data by companies. Since then, the clause has been used by EU regulators to send clear messages to big technology companies: Data privacy is sacrosanct, and record fines await in the case of failure to comply.

While $1.7bn might sound like a very large fine, that's just because no one has taken the rules on data protection enforcement very seriously until now.  Uber representatives did not immediately respond to comments, but in a statement to Reuters, the company said it would be appealing against the decision.