[Enforcement library](/enforcement)

# Uber: driver-data transfers needed safeguards beyond a US server location

The Dutch authority fined Uber EUR 290 million over transfers of European drivers' data to the United States without the required safeguards.

## Key facts

- **Regulator or court:** Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
- **Jurisdiction:** Netherlands / European Union
- **Framework:** GDPR Articles 44, 46 and 49
- **Record date:** 2024-07-22
- **Procedural status:** Administrative fine; later objection or appeal outcome not established

The Dutch authority fined Uber EUR 290 million over transfers of European drivers' data to the United States without the required safeguards.

Dutch Data Protection Authority (Autoriteit Persoonsgegevens) · GDPR Articles 44, 46 and 49 · Decision: 22 July 2024

## The problem

An account, licence or payment-data flow can be a transfer issue even when no advertising tag or consent banner is involved.

- The problem
- Case record
- What the authority found
- Outcome and limits
- Checks for your own systems
- How Inth helps
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | Dutch Data Protection Authority (Autoriteit Persoonsgegevens) |
| Jurisdiction | Netherlands / European Union |
| Law | GDPR Articles 44, 46 and 49 |
| Decision date | 22 July 2024 |
| Recorded fine | EUR 290,000,000 |
| Procedural status | Administrative fine; later objection or appeal outcome not established |
| Source review | 19 October 2026 |

Primary record: [Dutch authority notice published on EDPB](https://www.edpb.europa.eu/news/dutch-sa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to_en).

## What the authority found

The Dutch authority's notice describes European drivers' account, licence, location, payment and identity information retained on US servers, with criminal or medical information in some cases. [Dutch authority notice published on EDPB](https://www.edpb.europa.eu/news/dutch-sa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to_en).

It found that transfers over more than two years lacked the required transfer tools. The notice distinguishes that historic period from Uber's later use of the successor to Privacy Shield. [Dutch authority notice published on EDPB](https://www.edpb.europa.eu/news/dutch-sa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to_en).

## Outcome and limits

The authority imposed EUR 290,000,000. This record describes the cited administrative decision and does not establish the outcome of later objections or appeals, payment, or the legality of every current transfer. [Dutch authority notice published on EDPB](https://www.edpb.europa.eu/news/dutch-sa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to_en).

## Checks for your own systems

These are implementation checks suggested by Inth, not additional findings about the company.

- Inventory backend storage, group-company transfers and overseas support access, not just browser destinations.
- Keep records of the mechanism and supplementary measures relied on for each transfer period.
- Have counsel assess the applicable transfer route and the practical protection of the data.

## How Inth helps

Audits can help identify reviewed outbound flows and observable vendor destinations.

Inth does not establish international-transfer compliance or determine whether contractual safeguards provide essentially equivalent protection.

## Sources and limits

- [Dutch authority notice published on EDPB](https://www.edpb.europa.eu/news/dutch-sa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to_en)

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.