The Dutch Data Protection Authority (DPA) has imposed a €290 million ($324 million) fine on Uber for violating the EU's General Data Protection Regulation (GDPR) by improperly transferring driver data to the United States.

The DPA highlighted that while standard clauses may permit data transfers, Uber failed to ensure equivalent protection for this data after August 2021.

This fine, announced on August 26, 2024, underscores the ongoing regulatory challenges Uber faces in Europe regarding data privacy practices.

This penalty is the largest ever imposed by the DPA and reflects a broader trend of increasing scrutiny on tech companies concerning their data privacy practices.

The investigation, which began following complaints from over 170 French drivers, was conducted in collaboration with France's data protection authority, CNIL.

The complaints were initially filed with the French authority but were transferred to the Dutch DPA due to Uber's European headquarters being located in the Netherlands.

This enforcement action is part of a larger trend of regulatory actions against technology companies for non-compliance with data protection laws.

Uber has claimed to have implemented measures by the end of 2023 to comply with existing privacy rules, asserting that it maintained GDPR compliance even after the invalidation of the Privacy Shield.

In response to the fine, Uber announced plans to appeal the decision, arguing that the ruling was erroneous and the penalty unjustified given the legal uncertainties surrounding data transfers.

Despite Uber's arguments, the DPA upheld the fine, stating it was justified based on the company's failure to comply with GDPR requirements.

Despite the fine, Uber continues to hold a dominant position in the rideshare market, with a 25% share globally, which may influence future data protection practices in the U.S.

Following the DPA's ruling, drivers involved are considering a group action for compensation, further complicating Uber's legal landscape.