3 ms·

> How would the government even know that a big company is transgressing the rules? By investigating a complaint? From the article: The Dutch DPA started the

by tpm 2y ago

> How would the government even know that a big company is transgressing the rules? By investigating a complaint? From the article: The Dutch DPA started the investigation on Uber after more than 170 French drivers complained...

znpy 2y ago
Your comment and the article however don’t explain what the group complained about and how did they know data was being transmitted to the us, though. Did they made the allegations up and they happened to be right? I don’t think that’s the case.
- ivan_gammel 2y ago
  Under GDPR an EU citizen has right to request the details of how their personal data is collected and processed. This and, for example, checking the traffic with your data (eg IP address of sender of an email from CRM) would be enough.
- codedokode 2y ago
  For example, an email could come from US server containing their name. Or the website with the driver's account might be located on US server.
- bux93 2y ago
  The DPA has powers of subpoena. They can basically raid the place. Usually, companies don't want this to happen and they co-operate. How exactly did the DPA know that Uber processes all data in their central IT department in the US? Uber probably told them and didn't try to pretend they have any local hardware or entity in charge of it. That would be a stupid thing to lie about? In any event the fine is mostly for not having adequate protections in place. Those protections? Better contracts between wholly-owned subsidiaries of Uber. So, not much protection at all! This is very much Uber shooting themselves in the foot by not doing their homework. Again. This is the DPA's press release: https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-d... The fine is here, and is 48 pages long, and in Dutch: https://www.autoriteitpersoonsgegevens.nl/documenten/boete-uber-doorgifte-naar-vs https://www.autoriteitpersoonsgegevens.nl/documenten/boete-u... The investigation report isn't included. It may surface if Uber decided to right the fine and take it to court. Or, if some-one takes an interest and tries to get it via the local 'freedom of information act' equivalent, though that might take just as long and will result in a heavily redacted version being made available.
  - znpy 2y ago
    you are missing the point entirely. the DPA has subpoena powers, sure. But before the DPA can get involved, there must be a complaint. Such complaint came from Ligue des droits de l’Homme (LDH) and here is my question: how was this group informed that Uber was sending data to the US? No doubt about what happens when the DPA gets involved, I'm not arguing over that.

by tpm 2y ago

znpy 2y ago

Your comment and the article however don’t explain what the group complained about and how did they know data was being transmitted to the us, though. Did they made the allegations up and they happened to be right? I don’t think that’s the case.

ivan_gammel 2y ago
Under GDPR an EU citizen has right to request the details of how their personal data is collected and processed. This and, for example, checking the traffic with your data (eg IP address of sender of an email from CRM) would be enough.
codedokode 2y ago
For example, an email could come from US server containing their name. Or the website with the driver's account might be located on US server.
bux93 2y ago
The DPA has powers of subpoena. They can basically raid the place. Usually, companies don't want this to happen and they co-operate. How exactly did the DPA know that Uber processes all data in their central IT department in the US? Uber probably told them and didn't try to pretend they have any local hardware or entity in charge of it. That would be a stupid thing to lie about? In any event the fine is mostly for not having adequate protections in place. Those protections? Better contracts between wholly-owned subsidiaries of Uber. So, not much protection at all! This is very much Uber shooting themselves in the foot by not doing their homework. Again. This is the DPA's press release: https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-d... The fine is here, and is 48 pages long, and in Dutch: https://www.autoriteitpersoonsgegevens.nl/documenten/boete-uber-doorgifte-naar-vs https://www.autoriteitpersoonsgegevens.nl/documenten/boete-u... The investigation report isn't included. It may surface if Uber decided to right the fine and take it to court. Or, if some-one takes an interest and tries to get it via the local 'freedom of information act' equivalent, though that might take just as long and will result in a heavily redacted version being made available.
- znpy 2y ago
  you are missing the point entirely. the DPA has subpoena powers, sure. But before the DPA can get involved, there must be a complaint. Such complaint came from Ligue des droits de l’Homme (LDH) and here is my question: how was this group informed that Uber was sending data to the US? No doubt about what happens when the DPA gets involved, I'm not arguing over that.