Regulator action · 26 August 2024
Dutch DPA decision on Uber (driver data transfers to the US)
Autoriteit Persoonsgegevens, decision of 22 July 2024 (announced 26 August 2024) · Autoriteit Persoonsgegevens (Netherlands)
On appeal. Uber said it would object to the decision.
What it means for your code
Moving EU user data to a US region or US-owned processor requires a transfer mechanism before the first byte moves.
What happened
Uber stored European drivers' personal data, including location, identity documents and some criminal and medical data, on US servers without a valid transfer tool after ceasing to use SCCs.
What was decided
Transferring personal data to the US without an Article 46 transfer tool infringed Chapter V GDPR.
⚖ EUR 290 million administrative fine
The legal test applied
- Transferring personal data to a third country without an Art. 46 transfer tool infringes Chapter V
What would have changed the outcome
- Recipients certified under the Data Privacy Framework, or SCCs with a transfer impact assessment in place
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.