Uber hid drivers’ data rights, Dutch watchdog rules, stands by €10M penalty

The Dutch privacy and data protection authority (DPA) has ruled that Uber’s appeal against a €10 million fine is unfounded.

In January 2024, the privacy supervisor in the Netherlands imposed a €10 million fine on Uber for several violations of the General Data Protection Regulation (GDPR).

The DPA ruled that Uber made it unnecessarily complicated for drivers to request access to their personal data. Although the company’s app did contain a digital form to exercise the right of access, it was buried too deeply and scattered across various menus.

In addition, the regulator stated that company documents, such as guidelines, were provided to drivers in incomprehensible language. Furthermore, Uber provided insufficient information in its privacy statement about the retention period for drivers’ data and the countries to which their data was transferred.

“Drivers have a right to know how Uber handles their personal data. However, this was not transparent: Uber should have provided drivers with better and more detailed information,” DPA Chairman Aleid Wolfsen said in a statement at the time.

Wolfsen added that Uber created significant obstacles for drivers who wanted to exercise their right to privacy.

“That is unacceptable. Uber should have supported the drivers instead. That is also what the law says,” he concluded.

Uber immediately announced that it would appeal the regulator’s decision to impose a €10 million fine.

The taxi company argued during the objection procedure that its privacy policy complied with the GDPR and that it had since introduced improvements.

However, the privacy supervisor said those changes don’t undo the violations that took place. Therefore, the regulator decided to uphold both the findings and the amount of the fine.

The DPA has now definitively rejected Uber’s appeal.

Uber has announced it will take the case to court.

Unlock more exclusive Cybernews content on YouTube.