Uber: driver-data transfers needed safeguards beyond a US server location
The Dutch authority fined Uber EUR 290 million over transfers of European drivers' data to the United States without the required safeguards.
The problem
An account, licence or payment-data flow can be a transfer issue even when no advertising tag or consent banner is involved.
€290m
- Regulator or court
- Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
- Jurisdiction
- Netherlands / European Union
- Framework
- GDPR Articles 44, 46 and 49
- Decision
- Procedural status
- Administrative fine; later objection or appeal outcome not established
International data transfers · Sensitive context in event data
Case record
- Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
- Netherlands / European Union
- GDPR Articles 44, 46 and 49
- 22 July 2024
- EUR 290,000,000
- Administrative fine; later objection or appeal outcome not established
- 19 October 2026
Primary record: Dutch authority notice published on EDPB.
What the authority found
The Dutch authority’s notice describes European drivers' account, licence, location, payment and identity information retained on US servers, with criminal or medical information in some cases. Dutch authority notice published on EDPB.
It found that transfers over more than two years lacked the required transfer tools. The notice distinguishes that historic period from Uber’s later use of the successor to Privacy Shield. Dutch authority notice published on EDPB.
Outcome and limits
The authority imposed EUR 290,000,000. This record describes the cited administrative decision and does not establish the outcome of later objections or appeals, payment, or the legality of every current transfer. Dutch authority notice published on EDPB.
Checks for your own systems
These are implementation checks suggested by Inth, not additional findings about the company.
- Inventory backend storage, group-company transfers and overseas support access, not just browser destinations.
- Keep records of the mechanism and supplementary measures relied on for each transfer period.
- Have counsel assess the applicable transfer route and the practical protection of the data.
How Inth helps
Audits can help identify reviewed outbound flows and observable vendor destinations.
Inth does not establish international-transfer compliance or determine whether contractual safeguards provide essentially equivalent protection.
Sources and limits
Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.