All news
Enforcement May 22, 2026 7 min

Netherlands: the EUR 290 million Uber fine and the Dutch Authority's new priorities for 2026

Transfer of EU driver data to US servers without adequate safeguards. The Dutch AP focuses on mass surveillance, AI and digital resilience

TL;DR for the DPO

The Dutch Authority (AP) fined Uber EUR 290 million for transferring EU driver data to US servers without adequate Chapter V GDPR safeguards. One of Europe's highest fines. For 2026-2027 the AP set three priorities: mass surveillance, artificial intelligence, digital resilience. It is also starting random inspections of municipalities (processing registers, DPIAs, DPO independence).

The Uber case

Following complaints from French drivers, the Dutch AP (Uber's European HQ is in Amsterdam) found that Uber transferred EU drivers' personal data to the United States without adopting the safeguards required by Chapter V of the GDPR for non-EU transfers.

290MEUR
Dutch AP fine
Official source:EDPB - Dutch SA fines Uber EUR 290M

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Enforcement
€16,7Mfor telemarketing and contracts activated without consent

Italian DPA fines Wind Tre €16.7 million: telemarketing despite objections and contracts activated without customers' knowledge

People who had objected kept receiving calls, and some contracts were activated without the person knowing. The Garante fines Wind Tre €16.7 million and restates a principle for every company with an agency network: responsibility is not outsourced along with sales.

Oct 12, 2026New 5 min
Enforcement
€350kto controller and processor over outdated systems

Greece: €350,000 for a data breach — both the Ministry and the processor running outdated systems fined, and there was no Article 28 contract

An attack on the systems of the agency running a Ministry's programmes exposed identification, financial and health data of a very large number of people. The Hellenic DPA fines the controller €200,000 and the processor €150,000: notifying well is not enough if the supplier works on outdated systems and the relationship is not governed by a contract.

Oct 08, 2026New 5 min
Enforcement
€4kfor a camera pointed at a home

Italian DPA fines the municipality of Arvier €4,000: a camera filmed a resident's windows and balconies, and the masking came too late

A small municipality in the Aosta Valley uses cameras for traffic, parking, number plates, the environment and civil protection. A resident finds that one covers her home. The Garante imposes a fine and makes a point that applies to every system: masking private areas is designed before the camera is switched on, not after the complaint.

Oct 08, 2026New 5 min