21st Mar 2018


Uber may face fines in EU for keeping data breach secret

  • Uber promotional photo. Personal information from some 57 million users have been accessed by hackers (Photo: Uber)

US technology company Uber may face fines in the EU over its cover-up of a large-scale data breach, in a case which highlights new rules to come into force in the EU next year.

On Tuesday (21 November) the company's CEO Dara Khosrowshahi announced in a statement that "personal information of 57 million Uber users around the world" was acquired by two hackers in "late 2016".

Thank you for reading EUobserver!

Subscribe now for a 30 day free trial.

  1. €150 per year
  2. or €15 per month
  3. Cancel anytime

EUobserver is an independent, not-for-profit news organization that publishes daily news reports, analysis, and investigations from Brussels and the EU member states. We are an indispensable news source for anyone who wants to know what is going on in the EU.

We are mainly funded by advertising and subscription revenues. As advertising revenues are falling fast, we depend on subscription revenues to support our journalism.

For group, corporate or student subscriptions, please contact us. See also our full Terms of Use.

If you already have an account click here to login.

Additionally, the names and driver's licence numbers of around 600,000 Uber drivers from the US were hacked.

The breach had been kept secret, and Uber did not notify the affected consumers or regulators. Moreover, according to Bloomberg, the company paid the hackers a sum of $100,000 (€85,000) to keep quiet.

Khosrowshahi did not specify whether data from European customers were also involved.

When approached by this website, Uber did not want to comment on the record.

An Uber source told EUobserver that the company was in the process of notifying government authorities, and was not able to give more details until that was over.

However, given that the company last year said it had some 40 million monthly active users, it can be expected that European consumers will be affected.

If that is the case, then the company could face fines under the Dutch Data Protection Act, because it is registered in Amsterdam.

Since 1 January 2016, the Dutch legislation includes a data breach notification obligation.

A spokeswoman for the Dutch Data Protection Authority told this website that companies are obliged to report data breaches to the authority "without delay".

She could not comment on the Uber case and said that whether a company is fined for not reporting a data breach depended "on the context".

In cases where sensitive personal data is involved, companies are also required to inform the affected consumers.

Uber said that the information to which hackers acquired access, "included names, email addresses and mobile phone numbers", which may not be seen as 'sensitive'.

If the Dutch Data Protection Authority determines that Uber has broken the Dutch law, the company could face a fine of up to €820,000 – almost ten times what it reportedly paid the hackers.

General data protection regulation

But the bill could have been much higher had the incident happened after 25 May 2018, when new EU data protection legislation comes into force.

The general data protection regulation (GDPR) will make it much more expensive for companies to act like Uber did.

From then on all companies and organisations which collect data from EU citizens, should inform the responsible data protection authority in case of a data breach.

If such a breach is "likely to result in a high risk to the rights and freedoms" of those citizens, they must also be informed.

Names, e-mail addresses, and phone numbers may not fall in that category, but driver's licence numbers almost certainly will.

Failing to report breaches of sensitive personal data after 25 May 2018, could lead to a fine of up to €10 million, or two percent of the company's annual turnover, whichever is higher.

In Uber's case, the latter would have amounted to around €110 million.

Beyond that, the case is likely to do damage to Uber's reputation in Europe.

The company was recently labelled as transport company by one of the EU's highest lawyers, and it has been the subject of many controversies over the past few years.

EU gives thumbs up to US data pact

Commission gives 'thumbs-up' to controversial Privacy Shield deal with US on data sharing after a year's operation - but notes room for improvement.

EU to force firms to report major cyber attacks

Negotiators from the European Parliament and national governments have reached an agreement on new cyber-security rules. Amazon, Ebay and Google are expected to be affected.

Uber is a transport service, EU court rules

Ruling means that national governments have the right to demand that Uber drivers request the same permits and authorisations required of taxi drivers.

Stakeholders' Highlights

  1. EUobserverHiring - Sales Associate With 2+ Years Experience - Apply Now!
  2. EUobserverHiring - Finance Officer With Accounting Degree or Experience - Apply Now!
  3. ECR GroupAn Opportunity to Help Shape a Better Future for Europe
  4. Counter BalanceControversial Turkish Azerbaijani Gas Pipeline Gets Major EU Loan
  5. World VisionSyria’s Children ‘At Risk of Never Fully Recovering', New Study Finds
  6. Macedonian Human Rights MovementMeets with US Congress Member to Denounce Anti-Macedonian Name Negotiations
  7. Martens CentreEuropean Defence Union: Time to Aim High?
  8. UNESDAWatch UNESDA’s President Toast Its 60th Anniversary Year
  9. AJC Transatlantic InstituteAJC Condemns MEP Ana Gomes’s Anti-Semitic Remark, Calls for Disciplinary Action
  10. EPSUEU Commissioners Deny 9.8 Million Workers Legal Minimum Standards on Information Rights
  11. ACCAAppropriate Risk Management is Crucial for Effective Strategic Leadership
  12. EPSUWill the Circular Economy be an Economy With no Workers?

Latest News

  1. Judicial reforms 'restore balance', Poland tells EU
  2. Whistleblower fears for life as US arrest Malta bank chair
  3. Behind the scenes at Monday's EU talks on Russia
  4. US yet to push on Nord Stream 2 sanctions
  5. EU mulls coercion to get refugee kids' fingerprints
  6. Five east European states prevent new CAP consensus
  7. EU to probe UK 'election-rigging' firm
  8. 'Denial' - is meat the new climate change?

Stakeholders' Highlights

  1. European Jewish CongressThe 2018 European Medal of Tolerance Goes to Prince Albert II of Monaco
  2. FiscalNoteGlobal Policy Trends: What to Watch in 2018
  3. Human Rights and Democracy NetworkPromoting Human Rights and Democracy in the Next Eu Multiannual Financial Framework
  4. Mission of China to the EUDigital Cooperation a Priority for China-EU Relations
  5. ECTACompetition must prevail in the quest for telecoms investment
  6. European Friends of ArmeniaTaking Stock of 30 Years of EU Policy on the Nagorno-Karabakh Conflict: How Can the EU Contribute to Peace?
  7. ILGA EuropeCongratulations Finland!
  8. UNICEFCyclone Season Looms Over 720,000 Rohingya Children in Myanmar & Bangladesh
  9. European Gaming & Betting AssociationEU Court: EU Commission Correct to Issue Guidelines for Online Gambling Services
  10. Mission of China to the EUChina Hopes for More Exchanges With Nordic, Baltic Countries
  11. Macedonian Human Rights MovementCondemns Facebook for Actively Promoting Anti-Macedonian Racism
  12. Nordic Council of MinistersGlobal Seed Vault: Gene Banks Gather to Celebrate 1 Million Seed Collections