Uber Technologies Inc. and Uber B.V. – €10,000,000 Fine (Netherlands, 2023)

The French human rights organisation Ligue des droits de l'Homme (LDH) filed a complaint with the French DPA (Commission Nationale de l'Informatique et des Libertés, CNIL), on behalf of 172 Uber drivers against Uber B.V. and its US-based parent company Uber Technologies Inc., as joint controllers. The drivers, as data subjects, were complaining about the lack of information provided by the controllers (hereinafter Uber) in violation of Articles 12, 13 and 15 GDPR and the limited accessibility to the form used to exercise their rights under the GDPR. The CNIL then forwarded the complaint to the Dutch DPA (Autoriteit Persoonsgegevens, AP) as lead supervisory authority in the case according to Article 56 GDPR and initiated an Article 60 GDPR procedure. In the course of its investigations, the AP found several violations related to transparency and issued a report which it forwarded to Uber to submit its views. Upon hearing the views of the controller and of the concerned supervisory authorities in the case, the AP issued its final decision on 11 December 2023. First of all, the AP assessed the accessibility of Uber’s form for access requests and for exercising other data subjects' rights under the GDPR. In this respect, the AP found that the form available in the Uber app is not sufficiently easily accessible as it involves too many non-intuitive steps, contrary to the provision in Article 12(2) GDPR. This was also reinforced by the fact that, according to the investigations, the Uber app is the primary means of communication between Uber and its drivers, hence, at least there, the exercise of their rights should be facilitated. The AP clarified that a layered information structure can be used in such forms but there has to be a fair balance between the number of steps to be completed and the amount of information included in each step and on top of that, the steps should have clear and intuitive names. Using the steps named "Help", "Account and app issues" or "Acc