The Dutch AP and the Uber Fine
In August 2024, the Dutch AP fined Uber €290 million. Uber sent EU driver data to US servers with no legal basis. That data included taxi licenses, criminal checks, medical records, and travel logs.
Uber moved the data after Schrems II struck down the EU-US Privacy Shield in July 2020. It kept those transfers running for two years. No Standard Contractual Clauses. No Article 46 tool of any kind.
This fine is the EU's largest for a data transfer breach. It ranks third among all GDPR fines ever. Transfer failures now carry huge costs. Not just breaches.
See our GDPR conformance guide for a quick overview.
AP Enforcement Priority Areas
The Dutch AP received over 21,400 complaints in 2023. It focuses on three areas.
Priority 1 — Worker monitoring (43% of cases): Many Netherlands firms have faced AP fines for watching their staff. Hidden cameras, bulk email checks, and GPS tracking without notice all trigger action. Dutch labor law adds extra rules on top of GDPR.
Priority 2 — Cross-border transfers (31% of cases): After the Uber fine and a joint probe with Ireland's DPC on Cloudflare (2023), the AP stepped up transfer oversight. Amsterdam's tech sector faces high risk here. Cloud firms, fintech, and fast-growth startups are all in scope.
Priority 3 — Marketing and profiling (26% of cases): This covers cookie consent, ad targeting, and direct marketing. The AP takes a strict view of "legitimate interest." It requires written tests with clear evidence.
Transfer Rules After Uber
Transfer Impact Assessments (TIAs): The EDPB requires a TIA for every transfer to a third country. The TIA must show the destination gives equal protection to EU law. The AP says a TIA must answer four questions:
- What are the access laws in the destination country?
- How far can the spy agencies reach?
- What is the track record of government requests to the data importer?
- What legal remedies can data subjects use?
Standard Contractual Clauses — not enough on their own: SCCs alone do not satisfy Article 46. If the TIA shows government access risk, extra safeguards are required.
Extra technical measures the AP accepts:
- Encryption where the importer has no access to decryption keys
- Removing direct IDs before transfer so the importer cannot link the data back to a person
- Data reduction before transfer, cutting fields the importer does not need
The offline Desktop App runs all work on your device. It sends no data outside. This removes the transfer issue for that activity. See our security and compliance overview.
Employee Data and Dutch Labor Law
The AP's 43% focus on worker monitoring shows how GDPR and Dutch labor law overlap.
Three rules apply for Netherlands-based organizations:
Works council sign-off: A company with a works council must get its approval before rolling out any monitoring tool. This covers AI tools, email checks, and attendance systems.
Fit for purpose: Monitoring must match its stated goal. Hidden monitoring is not allowed. Open monitoring must be the least intrusive option.
Purpose limitation: HR data collected for one goal cannot be used for another. A new legal basis is needed.
These rules require three records: the council sign-off, the purpose check, and the controls. Our compliance checklist covers all three.
Netherlands PII Detection
PII tools in the Netherlands must handle local ID formats. Standard global tools often miss them:
- BSN (Burger Service Nummer): 9-digit Dutch national ID — requires checksum validation
- IBAN (NL prefix): Dutch IBAN with its own validation logic
- Postal code (postcode): Format is 4 digits + space + 2 letters
- DigiD: Government digital identity code
- Healthcare numbers: BGZ and EP formats for patient records
A generic tool may catch IBAN but miss the BSN checksum or postcode format. Test BSN detection before you process national identity data. Do not assume coverage.
Steps for Netherlands Organizations
1. Transfer audit: List all data flows to third countries. Review SCCs in place. Run TIAs for key flows. Record extra technical measures where a TIA flags risk.
2. Worker monitoring review: List all monitoring tools, including AI. Check works council sign-off records. Confirm purpose checks exist in writing.
3. PII coverage check: Test BSN, postcode, and IBAN detection in your PII tools. Test accuracy on Dutch-language documents.
4. Tech sector exposure: Startups should record choices that cut transfer risk — EU-region cloud and local processing options. Cloud providers with EU-US setups should document their transfer tools and TIA approach.
anonym.legal uses EU-based Hetzner data centers with zero-knowledge design. The server never sees your plain-text content. A full server breach yields only AES-256-GCM ciphertext. Need local-only processing? The Desktop App runs entirely on your device with no external connections.
Sources
- Dutch AP: Autoriteit Persoonsgegevens official site — VERIFIED-EXTERNAL
- Dutch AP: Uber enforcement decision (August 2024) — VERIFIED-EXTERNAL
- EDPB: Recommendations 01/2020 on supplementary measures — VERIFIED-EXTERNAL