Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The Dutch Data Protection Authority fined Uber B.V. and Uber Technologies Inc. €290 million on July 22, 2024, after finding that European drivers’ personal data was transferred to the United States without appropriate GDPR safeguards. The decision covered transfers from August 6, 2021, until late November 2023, and Uber’s appeal remained pending in the latest source located.
The case was not a finding that Uber necessarily suffered a conventional cybersecurity breach or publicly exposed the data. The legal issue was whether Uber had a valid GDPR transfer mechanism and whether that mechanism protected European personal data adequately in practice.
Key takeaways
- The Dutch Data Protection Authority fined Uber B.V. and Uber Technologies Inc. €290 million under GDPR Article 44 for international data transfers that lacked appropriate safeguards.
- The relevant transfer period ran from August 6, 2021, until late November 2023, when Uber became covered by the EU–U.S. Data Privacy Framework.
- The transferred information included driver account, licensing, location, photograph, payment, and identity-document data, plus criminal or medical information in some cases.
- The decision concerned the legality of cross-border access and transfer arrangements, not a blanket ruling that all U.S. storage or U.S.-related processing is unlawful.
- Uber disputed the decision and appealed; Uber’s 2025 governance report said the fine was stayed during the appeal, and no later final outcome was located in the research available for this article.
What exactly did the Dutch regulator decide?
The Autoriteit Persoonsgegevens, or Dutch Data Protection Authority, adopted a €290 million administrative fine against Uber B.V. and Uber Technologies Inc. on July 22, 2024. Public summaries identified GDPR Article 44 as the relevant legal provision. The Dutch regulator said Uber transferred personal data about European drivers to the United States without an appropriate transfer mechanism or sufficient safeguards.
Free tools Windows power users keep installed
One-click scans. No signup required.
The AP publicly announced the decision on August 26, 2024. The official AP decision is the primary source for the decision, penalty, legal basis, and procedural details.
Popular on Amazon
- FULL HD IPS DISPLAY - Enjoy vibrant, crystal-clear images with 178-degree wide-viewing angles
- AMD RYZEN 3 30 PROCESSOR - Everyday performance you can count on; Multitask, stream, game casually, and edit photos smoothly with responsive power and vibrant HDR visuals
- ENJOY UP TO 14 HOURS AND 15 MINUTES OF BATTERY LIFE - HP Fast Charge restores battery from 0 to 50% in approximately 45 minutes
- AMD RADEON 610M GRAPHICS - Experience smooth entertainment; Built for streaming and multitasking, enjoy realistic visuals and efficient performance for work and play
- STORAGE AND MEMORY - 512 GB PCIe NVMe M.2 SSD offers fast speed and efficient storage; and 8 GB LPDDR5 RAM memory boosts performance with higher bandwidth
What this fine was—and was not
- It was: an administrative GDPR fine concerning international transfers of European drivers’ personal data.
- It was not necessarily: a finding that Uber had experienced a conventional data breach, lost control of the data, or made the information publicly available.
- It was not: a blanket prohibition on every U.S. service, U.S. parent company, or U.S. data center.
- It did establish the compliance question: a company must use a valid transfer mechanism and ensure that the mechanism provides protection essentially equivalent to EU protection in practice.
Whose data did Uber transfer, and what did it contain?
The case involved personal data belonging to European Uber drivers. More than 170 French drivers complained through the Ligue des droits de l’Homme. According to the European Data Protection Board’s summary, the categories of information included:
- Driver account details
- Taxi-license information
- Location data
- Photographs
- Payment information
- Identity documents
- Criminal-record or other criminal-data information in some cases
- Medical information in some cases
Those categories should not be read as meaning that every driver’s file contained every type of information. The significance is that the data set went beyond ordinary contact details. It could combine identity, employment-related documentation, movements, financial information, and potentially special-category data.
Medical information is generally treated as special-category personal data under the GDPR, while criminal-record information is subject to additional protections. Worker and contractor information can also raise separate questions about access rights, employment law, automated decision-making, and the imbalance of power between an organization and the people whose data it processes.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Why were the U.S. transfers legally problematic?
The GDPR does not prohibit every transfer of European personal data to a country outside the European Economic Area. Instead, GDPR Chapter V requires the exporter to rely on a lawful transfer mechanism and to ensure that personal data receives an adequate level of protection in the destination and processing environment.
GDPR Article 44 describes the general principle for transfers to third countries and international organizations. A company cannot treat ordinary business necessity, membership in the same corporate group, or the existence of a U.S. parent as a transfer authorization. The relevant question is whether personal data was made available to, accessed by, or transferred to a U.S. entity or system under a valid mechanism with adequate protection.
The GDPR text on EUR-Lex provides the legal framework for both international transfers and enforcement penalties.
What counts as a transfer?
A transfer issue can arise even when the main database is physically located in Europe. Examples include:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- U.S.-based personnel remotely accessing records stored on European servers
- A U.S. parent company providing support, analytics, security, administration, or customer-service functions
- A cloud provider storing data in the EEA while allowing support access from the United States
- Backups, logs, disaster-recovery systems, monitoring tools, or subprocessors operating outside the EEA
- A corporate disclosure that gives a third-country entity practical access to personal data
Encryption can reduce exposure, but encryption alone does not automatically resolve a transfer-law problem. The analysis depends in part on who controls the keys, whether the importer can access plaintext, what access is technically possible, and whether supplementary organizational and contractual measures work in practice.
What happened to Privacy Shield, SCCs, and the Data Privacy Framework?
The Uber case is best understood as a timeline involving several different transfer arrangements, rather than as a simple consequence of the invalidation of Privacy Shield.
| Date | Event | Why it matters |
|---|---|---|
| July 16, 2020 | The Court of Justice of the European Union invalidated the EU–U.S. Privacy Shield in Schrems II. | Privacy Shield could no longer serve as the transfer mechanism for covered transfers. |
| August 6, 2021 | Public regulatory summaries identify this as the start of the relevant period in which Uber’s transfers lacked appropriate safeguards. | The enforcement period was not simply the date of the 2020 judgment; it concerned later transfer arrangements. |
| July 10, 2023 | The European Commission adopted the EU–U.S. Data Privacy Framework adequacy decision. | A new framework became available for eligible U.S. organizations within its scope. |
| Late November 2023 | Uber became covered by, or certified under, the Data Privacy Framework. | The regulator’s public summary says the violation had ended by this point. |
In Schrems II, the CJEU said that Standard Contractual Clauses could remain available, but only if the exporter and importer could ensure protection essentially equivalent to EU protection in practice. The CJEU judgment is the primary source for that ruling.
Public summaries state that Uber stopped using Standard Contractual Clauses for the relevant transfers beginning August 6, 2021. The summaries then place Uber’s coverage under the successor EU–U.S. Data Privacy Framework in late November 2023. The precise end date should be stated cautiously: the French regulator refers to November 21, while another legal summary refers to November 27. “Late November 2023” avoids presenting those differing public dates as a settled single date.
The European Commission’s Data Privacy Framework page explains the framework, but the framework is not universal permission for every U.S. transfer. A company relying on the framework must confirm that the particular U.S. recipient is certified and that the transfer falls within the certification’s scope.
How do the main transfer mechanisms compare?
| Mechanism | Advantage | Important limitation |
|---|---|---|
| Adequacy decision | Can simplify transfers to covered jurisdictions or covered recipients. | The decision, recipient eligibility, and scope must remain valid; the mechanism does not automatically cover every organization or processing activity. |
| Standard Contractual Clauses | Widely available and familiar for transfers involving separate organizations. | They require a transfer-impact assessment, practical enforceability, and supplementary measures where necessary. |
| Binding Corporate Rules | Can support recurring intra-group transfers across a multinational group. | They require substantial governance work and an approval process. |
| GDPR Article 49 derogation | Can address narrow, exceptional transfer situations. | Derogations are not a general replacement for routine and systematic international transfers. |
| EU-only processing | Can reduce exposure to third-country-transfer questions. | It may cost more, reduce operational flexibility, and still require review of remote access, vendors, and support arrangements. |
The European Commission’s Standard Contractual Clauses materials and the EDPB’s recommendations on supplementary measures are useful starting points for organizations documenting these decisions.
Why did the Dutch regulator handle complaints from French drivers?
The Dutch AP handled the investigation because Uber’s European headquarters are in the Netherlands. Under the GDPR’s one-stop-shop system, the supervisory authority in the location of a company’s main establishment can act as the lead authority for cross-border processing.
The complaints originated with more than 170 French Uber drivers and were represented by the Ligue des droits de l’Homme. France’s Commission Nationale de l’Informatique et des Libertés, or CNIL, cooperated as a concerned supervisory authority. The CNIL’s account of the case explains the French complaints, Dutch lead-authority role, and CNIL cooperation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The Dutch procedure does not mean that only Dutch drivers were affected. The case concerned European drivers’ data handled through Uber’s European corporate structure.
How large was the €290 million fine under the GDPR?
GDPR Article 83 permits fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher, for certain infringements. The €290 million Uber fine was the AP’s case-specific penalty; it should not be described as automatically equal to 4% of Uber’s global revenue.
The statutory maximum is a ceiling, not a formula that determines every fine. A regulator assesses the infringement and relevant aggravating or mitigating circumstances before setting a particular amount. The Library of Congress legal summary provides additional context on the GDPR penalty framework and the Uber decision.
Also popular on Amazon
- Intel Celeron N4120: 4 Cores & Threads, 1.1GHz Base Clock, Up to 2.6GHz Boost Clock, 4MB Cache, Intel UHD Graphics 600. The perfect combination of performance, power consumption, and value helps your device handle multitasking smoothly and reliably with four processing cores to divide up the work.
The €290 million transfer decision was separate from an earlier €10 million fine that the Dutch AP announced in January 2024 for transparency and data-subject-rights problems. The earlier sanction should not be combined with, or treated as the legal basis for, the international-transfer fine. The AP’s announcement of the €10 million fine describes that separate matter.
Did Uber admit wrongdoing, and is the fine final?
Uber did not admit the violation in the public material summarized for this article. Public reports said Uber disputed the decision, intended to appeal, and argued that the regulatory approach was flawed and that the period after Privacy Shield involved legal uncertainty. Those are Uber’s arguments, not established findings.
Uber’s 2025 Governance, Strategy and Engagement Report stated that the fine was stayed while the company appealed. As of August 18, 2026, the research available for this article did not locate a later final court or administrative disposition. The legally careful wording is therefore that the Dutch AP fined Uber and that the fine remained stayed during the appeal according to Uber’s report—not that Uber had finally lost, paid, or overturned the case.
The regulator’s public summary says Uber had ended the violation and was using the successor framework by late 2023. Corrective action can end an ongoing problem without eliminating possible liability for an earlier period.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does the Uber case mean for companies using U.S. systems?
The practical lesson is not “never use U.S. services.” The lesson is that companies must map international access and deliberately select, document, test, and monitor a GDPR Chapter V transfer mechanism.
Common failure modes
- Ignoring group-company access: A European subsidiary cannot assume that a U.S. parent’s access is irrelevant because both entities belong to the same corporate group.
- Treating EU hosting as the complete answer: European storage does not necessarily prevent a restricted transfer when U.S.-based personnel, administrators, or vendors can access the information.
- Assuming encryption automatically solves the problem: The company must examine key control, plaintext access, authentication, support access, and realistic government-access risks.
- Relying on an invalid or expired framework: A company must check the current legal status of its chosen mechanism instead of relying on an old privacy policy or contract.
- Using the Data Privacy Framework without checking eligibility: The specific U.S. recipient must be certified and within the relevant scope.
- Signing SCCs without analysis: Standard Contractual Clauses do not eliminate the need for a transfer-impact assessment or supplementary measures where the destination environment requires them.
- Forgetting hidden copies: Backups, logs, support systems, monitoring tools, disaster-recovery environments, and subprocessors need to be included in the data-flow review.
- Underestimating workforce data: Employee, contractor, and driver information can include identity documents, location information, medical information, and criminal-record data that require heightened care.
- Failing to reassess after legal change: A transfer arrangement can become unsuitable after a court ruling, regulatory decision, vendor change, or change in access model.
- Assuming remediation erases history: Moving to a lawful framework can stop a violation prospectively but does not necessarily remove liability for earlier transfers.
A practical international-transfer checklist
- Map the data: Record the categories, data subjects, systems, locations, recipients, purposes, retention periods, and access paths.
- Identify every U.S. connection: Include parent companies, affiliates, employees, support personnel, cloud administrators, vendors, subprocessors, telemetry systems, backups, and disaster recovery.
- Classify sensitivity: Separate ordinary account information from identity documents, location histories, payment data, medical data, and criminal-record information.
- Choose the mechanism: Determine whether an adequacy decision, Data Privacy Framework coverage, SCCs, Binding Corporate Rules, or a narrow Article 49 derogation is actually available.
- Verify the recipient: If relying on the Data Privacy Framework, confirm the recipient’s certification and scope. If relying on SCCs, confirm the correct parties, modules, onward-transfer terms, and implementation.
- Perform and document the assessment: Examine destination-country law, importer access, government-access risks, contractual protections, technical controls, and organizational safeguards.
- Apply supplementary measures: Consider encryption with appropriate key separation, access minimization, pseudonymization, strict administrator controls, logging, contractual limits, and technical barriers where appropriate.
- Test the real environment: Confirm that the architecture matches the contract. “EU region” labels are not enough if support or administration remains accessible from outside the EEA.
- Monitor continuously: Recheck certifications, subprocessors, legal frameworks, court decisions, vendor terms, and changes in personnel access.
- Prepare an exit plan: Know how to suspend transfers, delete or return data, redirect processing, and preserve evidence if the legal basis changes.
Can privacy software solve the transfer problem?
Privacy-management and data-governance software can help organizations discover sensitive data, maintain transfer inventories, manage vendors, document assessments, and automate data-subject requests. Software cannot itself create a lawful transfer mechanism or guarantee that a company is GDPR compliant.
Large organizations may evaluate platforms such as OneTrust for broad privacy-management workflows, BigID for data discovery and sensitive-data mapping, Transcend for rights-request orchestration, DataGrail for privacy-request connectivity, or Microsoft Purview for organizations already invested in Microsoft’s compliance ecosystem.
These products have different scopes. A broad enterprise platform may be excessive for a small organization with few systems. A data-discovery tool may identify where information sits but not resolve the legal interpretation. A rights-request platform may streamline access and deletion workflows but not replace a transfer-impact assessment. Buyers should examine each vendor’s own data locations, subprocessors, administrator access, telemetry, support model, and contractual transfer terms.
Organizations with limited cross-border processing may be better served by existing governance tools, EU-hosted infrastructure, self-hosted systems, or external privacy counsel. EU hosting can reduce some risks but does not automatically prove EU-only processing. Self-hosting offers more control while transferring responsibility for patching, monitoring, backups, encryption, and incident response to the customer.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhy this case matters beyond Uber
The Uber decision illustrates why international-transfer compliance is an operational issue rather than a clause hidden in a privacy notice. A company needs to know who can access data, from where, for what purpose, through which systems, under which legal mechanism, and with what technical and organizational controls.
The case also shows why sensitive workforce data deserves special attention. A driver record may combine identity documents, location, payment details, licensing information, and—depending on the individual—medical or criminal information. The more revealing the dataset, the less credible it is to rely on vague statements such as “the data is hosted in Europe” or “the vendor is part of our group.”
Finally, the case demonstrates that regulatory uncertainty is not a compliance strategy. Legal uncertainty may become relevant to an appeal or penalty assessment, but companies still need to reassess transfer arrangements when courts invalidate frameworks, regulators issue guidance, or new adequacy mechanisms become available.
Frequently Asked Questions
Did Uber pay the €290 million GDPR fine?
The latest source located for this article does not establish that Uber paid the fine. Uber’s 2025 governance report said the fine was stayed while the company appealed, and no later final outcome was located in the available research.
Does the Uber decision make all transfers of European data to the United States illegal?
No. The decision concerned Uber’s particular transfer arrangements and the Dutch regulator’s finding that the relevant transfers lacked appropriate safeguards. U.S. transfers can be lawful when a valid mechanism applies and provides adequate protection in practice.
Does storing personal data on servers in Europe prevent a GDPR transfer to the United States?
No. European storage may not prevent a restricted transfer if U.S.-based personnel, affiliates, cloud administrators, support teams, subprocessors, or other entities can access the data.
Was every Uber driver’s record found to contain medical or criminal information?
No. The regulator identified medical and criminal information in some cases, alongside broader categories such as account details, licensing data, location, photographs, payment information, and identity documents.
The Bottom Line
The Uber case is a warning against reducing GDPR international-transfer compliance to server geography. The decisive questions are who can access European personal data, which transfer mechanism authorizes that access, whether the mechanism works in practice, and whether the company can prove that its safeguards, vendors, backups, and remote-access controls match its legal analysis.
