In a significant development that has sent ripples through the tech world, Uber has been slapped with a €290 million fine by the Dutch Data Protection Authority (DPA). The penalty is one of the largest ever imposed for data protection violations in Europe, highlighting the serious repercussions of mishandling personal data under the EU’s stringent General Data Protection Regulation (GDPR).

The fine stems from Uber’s failure to safeguard the personal data of European drivers, including sensitive information such as identity documents, payment details, and even criminal and medical records. The Dutch DPA determined that Uber had transferred this data to servers in the United States without adhering to the required GDPR safeguards, a violation that persisted for more than two years.

Uber had previously relied on Standard Contractual Clauses (SCCs) for data transfer but discontinued their use in 2021. It wasn’t until late 2023 that the company adopted the Trans-Atlantic Data Privacy Framework, leaving a significant gap where data protection was compromised. This lapse in data security has not only damaged Uber’s reputation but also exposed the company to one of the most substantial fines ever issued under the GDPR.

The Dutch DPA’s decision has sparked controversy, with Uber strongly contesting the ruling. The ride-sharing giant has expressed its intent to appeal the fine, arguing that it continued to safeguard data during a period of “immense uncertainty” in the EU-US data transfer landscape. Despite this, the DPA’s stance remains firm, emphasizing the importance of protecting European citizens’ data, especially when it is transferred outside the EU.

This latest fine is not the first for Uber. The company has faced penalties from the Dutch DPA before, including a €10 million fine in 2023. However, the magnitude of the current fine underscores the growing resolve of European regulators to enforce GDPR compliance rigorously.

The ruling is expected to have broader implications for other tech companies, particularly those that operate across borders and handle large volumes of personal data. It serves as a stark reminder that non-compliance with GDPR can lead to severe financial consequences, regardless of a company’s global stature.

As Uber prepares to contest the decision, the case will be closely watched by businesses and regulators alike, as it could set a precedent for future data protection enforcement actions across the EU.