Uber and the Dutch data protection authority: four fines, and where the EUR 290 million case stands

What we observe

The AP imposed a fine of EUR 290 million on Uber Technologies Inc. and Uber B.V., finding that Uber had infringed Article 44 of the General Data Protection Regulation (GDPR) by transferring personal data to the United States without the appropriate safeguards required by Chapter V [2, 3]. The decision is dated 22 July 2024 and was announced on 26 August 2024 [1, 3, 4]. The AP found that the infringement ran from 6 August 2021 to 27 November 2023 [3].

According to the AP, Uber collected sensitive information on drivers in Europe and retained it on servers in the United States, including account details and taxi licences, location data, photos, payment details, identity documents and, in some cases, criminal and medical data [1]. The AP says that because Uber no longer used Standard Contractual Clauses from August 2021, drivers' data were insufficiently protected, and that Uber has since used the successor to the Privacy Shield [1]. The AP describes this as a serious violation of the GDPR and states that Uber has ended it [1].

The case began with complaints from more than 170 French drivers to the Ligue des droits de l'Homme, which complained to the French authority. The AP led the case because Uber's European headquarters is in the Netherlands, and coordinated the decision with other European authorities [1, 4]. The AP notes that GDPR fines can reach 4% of worldwide annual turnover and that Uber's 2023 worldwide turnover was around EUR 34.5 billion [1].

The EUR 290 million fine was the third AP fine on Uber [1]. In November 2018 the AP fined Uber B.V. and Uber Technologies, Inc. EUR 600,000 for failing to report a 2016 data breach within 72 hours; the AP says around 57 million users worldwide were affected, including about 174,000 people in the Netherlands [8]. In a decision of 11 December 2023, announced on 31 January 2024, the AP fined Uber EUR 10 million for insufficient transparency about how long it kept European drivers' data and which countries outside Europe the data were sent to, and for making it hard for drivers to exercise their privacy rights [5, 7]. On 21 August 2026 the AP announced a fourth fine, of EUR 824,990,000. It found that between 2018 and 2022 Uber had taken fully automated decisions, without human review, to deactivate drivers' accounts temporarily or permanently on suspicion of fraud or after low customer ratings [11]. The AP states that Uber has announced it will object (AIO translation) [11].

Appeal status. Under Dutch administrative law, a fine is first contested by an objection (bezwaar) to the AP itself, and the AP's decision on the objection can then be appealed (beroep) to a court [3, 7]. For the EUR 290 million fine, the AP stated on 26 August 2024 that "Uber has indicated its intent to object to the fine" [1]. On 21 August 2026 the AP stated that Uber is contesting both the EUR 10 million and the EUR 290 million fines and that "the proceedings are still ongoing" (AIO translation) [11]. As at 28 October 2026, neither the AP nor the Dutch judiciary's published-rulings database (uitspraken.rechtspraak.nl) had published a decision on the objection to the EUR 290 million fine or a court ruling on it.

For the EUR 10 million fine, the position is documented. In a decision dated 3 March 2026, published on 8 May 2026, the AP declared Uber's objection unfounded and maintained the fine [6, 7]. The AP states: "Uber gaat in beroep bij de rechter tegen het besluit op bezwaar van de AP" (Uber is appealing to the court against the AP's decision on the objection) [6].

Why it matters

The EUR 290 million decision is about where drivers' data were stored and on what legal basis, not about an AI system as such. It does, however, show how a platform that manages workers through software is examined: in its decision the AP records that Uber drivers are directed by an algorithm in the driver app, set in advance by Uber, through which Uber controls the data processing (AIO translation) [3]. The decision also records Uber's description of access requests being prepared by a fully automated self-service process on Uber's US systems [3]. The AP's August 2026 fine concerns automated decision-making directly [11]. Large-scale processing of workers' data across borders is common to automated platforms, so the transfer rules tested here apply widely.

As at 28 October 2026 we found no published court ruling on any of the three most recent fines. The AP's decision on the objection to the EUR 10 million fine notes that lodging a court appeal does not suspend the decision (AIO translation) [7]. As at 28 October 2026 no decision on the objection to the EUR 290 million fine had been published, so its outcome should be checked again before this signal is relied on.

Method

Sources: AP press releases in English and Dutch, AP decision documents in Dutch, and a European Data Protection Board notice, all saved and read on 28 October 2026 [1-8, 10, 11]. We found no statement on the fine in a primary Uber source; Uber's quarterly report on Form 10-Q for the period to 30 June 2026, filed on 5 August 2026, does not mention the EUR 290 million fine [9]. Translations from Dutch are by the AIO Research Team. "Objection" translates bezwaar and "appeal" translates beroep. On 28 October 2026 we searched the AP's website and uitspraken.rechtspraak.nl for a decision on the EUR 290 million fine and found none.

References

1. [1] Autoriteit Persoonsgegevens. "Dutch DPA imposes a fine of 290 million euro on Uber because of transfers of drivers' data to the US", 26 August 2024. https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us. Accessed 28 October 2026.
2. [2] Autoriteit Persoonsgegevens. "Boete Uber doorgifte naar VS" (document page), 26 August 2024. https://www.autoriteitpersoonsgegevens.nl/documenten/boete-uber-doorgifte-naar-vs. Accessed 28 October 2026.
3. [3] Autoriteit Persoonsgegevens. Besluit tot oplegging bestuurlijke boete (Uber), 22 July 2024. https://www.autoriteitpersoonsgegevens.nl/system/files?file=2024-08%2FBesluit+boete+Uber+doorgifte+naar+VS.pdf. Accessed 28 October 2026.
4. [4] European Data Protection Board. "Dutch SA imposes a fine of 290 million euro on Uber because of transfers of drivers' data to the US", 26 August 2024. https://www.edpb.europa.eu/news/dutch-sa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to_en. Accessed 28 October 2026.
5. [5] Autoriteit Persoonsgegevens. "Uber krijgt boete van 10 miljoen euro voor overtreden privacyregels", 31 January 2024, updated May 2026. https://www.autoriteitpersoonsgegevens.nl/actueel/uber-krijgt-boete-van-10-miljoen-euro-voor-overtreden-privacyregels. Accessed 28 October 2026.
6. [6] Autoriteit Persoonsgegevens. "Besluit op bezwaar boete Uber", 8 May 2026. https://www.autoriteitpersoonsgegevens.nl/documenten/besluit-op-bezwaar-boete-uber. Accessed 28 October 2026.
7. [7] Autoriteit Persoonsgegevens. Besluit op bezwaar (Uber, EUR 10 million fine), 3 March 2026. https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-05/Besluit%20bezwaar%20boete%20Uber.pdf. Accessed 28 October 2026.
8. [8] Autoriteit Persoonsgegevens. "AP legt Uber boete op voor te laat melden datalek", 27 November 2018. https://www.autoriteitpersoonsgegevens.nl/actueel/ap-legt-uber-boete-op-voor-te-laat-melden-datalek. Accessed 28 October 2026.
9. [9] Uber Technologies, Inc. Form 10-Q for the quarter ended 30 June 2026, filed 5 August 2026 (SEC EDGAR). https://www.sec.gov/Archives/edgar/data/1543151/000154315126000032/uber-20260630.htm. Accessed 28 October 2026.
10. [10] Autoriteit Persoonsgegevens. "AP legt Uber boete op van 290 miljoen euro om doorgifte data chauffeurs naar VS", 26 August 2024. https://www.autoriteitpersoonsgegevens.nl/actueel/ap-legt-uber-boete-op-van-290-miljoen-euro-om-doorgifte-data-chauffeurs-naar-vs. Accessed 28 October 2026.
11. [11] Autoriteit Persoonsgegevens. "Uber krijgt boete van bijna 825 miljoen euro voor geautomatiseerd blokkeren van chauffeurs", 21 August 2026. https://www.autoriteitpersoonsgegevens.nl/actueel/uber-krijgt-boete-van-bijna-825-miljoen-euro-voor-geautomatiseerd-blokkeren-van-chauffeurs. Accessed 28 October 2026.