Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US
Dutch regulators have fined Uber €290M for transferring European drivers’ data to the US without a valid legal basis under GDPR, reigniting debate over cross‑border data flows. Commenters weigh the EU’s strong privacy enforcement against concerns about stifling “innovation” and fragmenting the once borderless internet, noting tensions between EU law, US surveillance powers, and frameworks like Privacy Shield and its successors. Many argue that large US tech firms are unlikely to abandon the lucrative European market, and that strict fines are necessary to prevent privacy violations from becoming a routine cost of doing business.
EU Privacy Culture vs U.S. Practices
- Many commenters applaud the fine as evidence the EU treats privacy as a fundamental right, unlike the U.S., where data exploitation is seen as normalized.
- Others argue the EU overstates its moral superiority, noting pervasive European surveillance and weak practical differences for users.
Innovation, Competition, and “Leaving Europe”
- One camp warns strict rules could reduce innovation and drive U.S. companies away, harming EU users.
- The dominant rebuttal: the EU market is too big to abandon; if some firms leave, local or non‑US competitors (e.g., Bolt, FreeNow, local delivery/taxi apps) will fill the gap.
- Several argue that what’s framed as “innovation” is often just worker exploitation or regulatory arbitrage, not genuine technical progress.
GDPR Enforcement and the Uber Case
- Many welcome proof that GDPR is “not just cookie banners,” criticizing banners and consent forms as mostly malicious or sloppy compliance.
- The Uber fine is tied to years where it transferred highly sensitive driver data to the U.S. without a valid legal mechanism after Privacy Shield was invalidated.
- Some note fines must be high enough to not become just “cost of doing business,” but others see the size and multi‑year appeal process as quasi‑political or a revenue grab.
EU–US Legal Conflict & Data Location
- There’s extensive discussion that U.S. laws (FISA 702, CLOUD Act, etc.) let U.S. authorities compel access to data, including non‑U.S. persons, even if stored in the EU.
- One view: this makes full compliance for U.S.-linked companies effectively impossible; fines punish companies for a geopolitical dispute.
- Counterview: that’s a U.S. problem; if U.S. law makes your company incompatible with EU rights, you shouldn’t handle EU personal data.
Global Internet Fragmentation & Tech Sovereignty
- Some lament the end of a borderless internet, predicting nationally siloed services and higher complexity.
- Others respond that fragmentation is a necessary reaction to abuse (mass surveillance, data brokerage, platform dominance), and that local, privacy‑respecting ecosystems are preferable.
Capitalism, Regulation, and Morality
- Multiple comments argue capitalism is structurally amoral and will exploit data unless regulated.
- Disagreement centers on whether current EU approaches are effective guardrails or overreach that risk long‑term competitiveness.