Uber has been fined €290 million by the Dutch Data Protection Authority for not implementing appropriate mandatory safeguards required under the General Data Protection Regulation (GDPR) before transferring the personal data of its drivers to the United States between 2021 and 2023.
For companies wishing to transfer personal data from the UK or EU to a “third country”, compulsory safeguards must first be implemented where that country is deemed not to have “adequate” levels of personal data security. Examples of such countries include the US, India and Turkey.
A “transfer” can simply mean where overseas companies can access personal data stored in the UK or EU, for example in personnel files and client databases. This often applies to group companies sharing personal data among the group. In the Uber case, personal data was retained on Uber’s servers in the US, and thereby “transferred” from Uber BV, their Netherlands entity, to Uber Technologies Inc, in the US.
The most popularly utilised safeguards, tend to be in the form of an international data transfer agreement – a set of prescribed clauses approved by the EU Commission or UK Government, as applicable, to ensure personal data shared is protected by each contracting party. In the EU, these are known as “Standard Contractual Clauses”, or “SCCs”, in the UK, simply an “International Data Transfer Agreement” or “IDTA”.
As in the Uber case, in the past, companies could rely on the EU-US Privacy Shield to compliantly make transfers to the US, however this was invalidated in 2020 and can no longer be used. A new system, known as the EU-US (or UK-US) Data Privacy Framework is now in place, but companies must first self-certify, and of course it is only applicable for transfers to the US. Uber has since signed up to the framework but there was a gap when the infringements of the GDPR occurred, and the fine has resulted.
While this judgment results from a breach of the EU General Data Protection, it is likely that the UK courts would follow the same approach under its mirroring data protection legislation, the UK GDPR.
The case highlights the importance of companies that are transferring personal data to, or sharing personal data with, companies located in “third countries” ensuring they are doing so compliantly with safeguards implemented where necessary. It is particularly relevant for multinational companies sharing personal data between entities.
Madeleine Rhodes mrhodes@redfernlegal.com
