Cross-Border Data Transfers Under GDPR: Lessons From Uber’s €290 Million Fine

Under the GDPR, organizations may only transfer data outside the EU's jurisdiction by relying on three mechanisms. These include an adequacy decision, appropriate safeguards such as binding corporate rules (BCRs), standard contractual clauses (SCCs), or specific derogations, which can only be used in the case of non-repetitive transfers. 

This investigation began after French Uber drivers complained about the company mishandling their sensitive data. The French data protection authority began its initial investigation. Then, it forwarded the complaint to the Dutch DPA since all such complaints must be forwarded to the DPA of the EU country where the alleged offending company is headquartered, which is the Netherlands in the case of Uber. 

Yes, Uber has disagreed with the decision and their plans to appeal the Dutch DPA's fine arguing that they had appropriate data protection mechanisms in place. Additionally, they contend that the transfer's legal basis was within the regulatory provisions.