Uber Technologies Inc. and Uber B.V. – €10,000,000 Fine (Netherlands, 2023)

The French human rights organisation Ligue des droits de l'Homme (LDH) filed a complaint with the French DPA (Commission Nationale de l'Informatique et des Libertés, CNIL), on behalf of 172 Uber drivers against Uber B.V. and its US-based parent company Uber Technologies Inc., as joint controllers. The drivers, as data subjects, were complaining about the lack of information provided by the controllers (hereinafter Uber) in violation of Articles 12, 13 and 15 GDPR and the limited accessibility to the form used to exercise their rights under the GDPR. The CNIL then forwarded the complaint to the Dutch DPA (Autoriteit Persoonsgegevens, AP) as lead supervisory authority in the case according to Article 56 GDPR and initiated an Article 60 GDPR procedure. In the course of its investigations, the AP found several violations related to transparency and issued a report which it forwarded to Uber to submit its views. Upon hearing the views of the controller and of the concerned supervisory authorities in the case, the AP issued its final decision on 11 December 2023. First of all, the AP assessed the accessibility of Uber’s form for access requests and for exercising other data subjects' rights under the GDPR. In this respect, the AP found that the form available in the Uber app is not sufficiently easily accessible as it involves too many non-intuitive steps, contrary to the provision in Article 12(2) GDPR. This was also reinforced by the fact that, according to the investigations, the Uber app is the primary means of communication between Uber and its drivers, hence, at least there, the exercise of their rights should be facilitated. The AP clarified that a layered information structure can be used in such forms but there has to be a fair balance between the number of steps to be completed and the amount of information included in each step and on top of that, the steps should have clear and intuitive names. Using the steps named "Help", "Account and app issues" or "Account" and "Legal concerns" or "Legal, ethics, and compliance" to reach the form allowing drivers to exercise their GDPR rights cannot be considered obvious in the AP's view; putting it under "Privacy" would have been more intuitive and easy. Hence, the AP found a violation of Article 12(2) GDPR. As regards the language of the form, the AP found that Uber provides information in a CSV file in response to access requests, without adding any guidance on how the information from such a file can be structured and interpreted. This, according to the AP and read in light of paragraph 11 of the [https://edpb.europa.eu/our-work-tools/our-documents/article-29-working-party-guidelines-transparency-under-regulation_en EDPB Guidelines on Transparency under Regulation 2016/679], cannot be considered an easily accessible form as data subject would have to find the information themselves. In addition, the AP found that, after adding guidance on how to open and read the CSV files, Uber only provided such information in English. Since Uber offers services in many EU countries, not only in France, this negatively affects virtually all Uber drivers in Europe as it cannot be considered “clear and simple” language under Article 12(1) GDPR. Accordingly, the AP held that Uber failed to provide information in an easily accessible form, using clear and plain language, thereby violating Article 12(1) GDPR. Further, the AP assessed the privacy policy of Uber first as regards retention periods, secondly with respect to transfers of personal data to third countries and lastly with respect to data portability. First, the AP held that Uber provided too general information regarding retention periods by merely stating that data will be stored for “as long as necessary”. In the AP’s view, it is true that mentioning all different retention periods would have resulted in an overly long privacy policy, but Uber should have at least indicated the criteria used to determine retention periods. Hence, the AP held that Uber violated Article 13(2)(a) GDPR and Article 15(1)(d) GDPR. Secondly, as regards transfers of personal data, the AP found that, by not mentioning the third countries to which personal data may be transferred nor the safeguards in place and where they can be accessed, Uber acted in violation of Article 13(1)(f) GDPR and Article 15(2) GDPR interpreted also in light of the above mentioned EDPB Guidelines. Thirdly, the privacy policy of Uber did not contain any reference to the possibility to exercise one’s right to data portability, thereby violating Article 13(2)(b) GDPR. In light of the above, in accordance with Article 58(2)(i) GDPR and Article 83 GPDR, the AP considered it appropriate to impose an administrative fine against Uber. In the calculation of the fine, the AP took several facts into account as well as the [https://edpb.europa.eu/our-work-tools/documents/public-consultations/2022/guidelines-042022-calculation-administrative_en EDPB Guidelines 04/2022 on the calculation of administrative fines under the GDPR]. In the AP's view, this case involves two distinct sanctionable conducts ("plurality of action"), namely the failure to provide sufficient information in the privacy policy, which is a continuous conduct and the violations found with respect to the form for exercising one’s rights, which occurs only when a request is made. Hence, according to the AP, the violations are independent form one another and should be fined separately. Taking into account mitigating factors, such as the fact that following the AP report issued by the AP in May 2022, Uber remedied some of the violations and considering the annual global turnover of Uber, the AP classified the gravity of the infringements as low and no substantive damage having been cause and decided to issue a fine in the amount of €5,000,000 for each offence, amounting to a total fine of €10,000,000 on Uber.