ARTICLE · 04 JANUARY 2019

Privacy & Information Security Law Blog: CNIL Fines Uber For Data Security Failure Related To 2016 Data Breach

Hunton Andrews Kurth LLP

Explore more from Hunton Andrews Kurth LLP

On December 20, 2018, the French data protection authority (the "CNIL") announced that it levied a €400,000 fine on Uber France SAS

United StatesPrivacy

Andrews Kurth LLP

Author LinkedIn connections

Background

On November 21, 2017, Uber Technologies Inc. published an article on its website revealing that two external individuals had accessed the personal data of 57 million Uber riders and drivers worldwide at the end of 2016.

On November 28, 2017, Uber B.V. sent a letter to the Chairman of the Article 29 Working Party ("Working Party") to describe the circumstances of the data breach and express its willingness to cooperate with all competent data protection authorities.

On November 29, 2017, the Working Party established a taskforce to coordinate the plethora of national investigations throughout the EU into Uber's 2016 data breach. This taskforce is composed of representatives from the Dutch, Spanish, French, Belgian, Italian, UK and Slovakian data protection authorities ("DPAs").

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

Related Articles

OCR Settles HIPAA Security Rule Violations For $700K

United StatesPrivacy

Hall Benefits Law

JM Bullion Data Breach: What Information Was Exposed?

United StatesPrivacy

Morgan & Morgan

Stitch Connect Data Breach: What Information Was Exposed?

United StatesPrivacy

Morgan & Morgan

CALPRIVACY REMINDER—DROP Cycle 1 Deadline Approaching—October 29, 2026 (And Other Reminders)

United StatesPrivacy

Troutman Amin LLP

Fifth Circuit Reverses Dismissal Of Adtech Class Action On Narrow Grounds, Finding Sufficient Factual Allegations Of Disclosure Of PHI

United StatesPrivacy

Duane Morris LLP

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

Comparative Guide

Data Protection & Cybersecurity

See more popular content from

Privacy

California Enacts First-of-Its-Kind Legislation Governing Lawyer AI Use

California Governor Newsom has signed Senate Bill 574 into law, establishing the nation's first statutory framework governing how attorneys and arbitrators use generative AI in their professional practice. The legislation creates specific obligations around confidentiality protection, accuracy verification, and disclosure requirements that take effect January 1, 2027.

United StatesPrivacy

Seyfarth Shaw LLP

SB 54 Is In Effect: What California’s New Packaging Law Means For Your Business

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.

United StatesPrivacy

Wilson Elser Moskowitz Edelman & Dicker LLP

Connecticut’s Newly Enacted Data Broker Law: How It Stacks Up Against California’s Delete Act

Connecticut’s Governor has signed into law Public Act No. 26-64, “An Act Concerning Consumer Privacy and Protection,” which introduces substantial new compliance obligations for businesses that operate as data brokers...

United StatesPrivacy

Davis+Gilbert LLP

California's Fall 2026 Privacy Roundup: Expanded CCPA Deletion Rights And More

California Governor Gavin Newsom has signed several significant privacy bills that will reshape how businesses handle consumer data, including expanded deletion rights under the CCPA, shortened data broker response cycles, and sweeping new insurance sector privacy requirements. While one landmark bill banning the sale of sensitive personal information was vetoed, the approved legislation requires companies to update their deletion workflows...

United StatesPrivacy

McDermott Will & Schulte

Is Your Business A "Data Broker"?: California's DROP Goes Live, And CALPrivacy Continues To Enforce Delete Act

Four states have adopted laws regulating data brokers, but only one – California – has established a universal deletion mechanism whereby consumers are able to request that all data brokers...

United StatesPrivacy

Eleventh Circuit Developments: Decisions On Florida And Georgia Social Media/Minor Laws And New Alabama Law

Legal risk intensifies for companies offering online interactive features to minors across Georgia, Florida, and Alabama as the Eleventh Circuit vacates preliminary injunctions against state social media laws. With Florida's HB 3 and Georgia's SB 351 now enforceable and Alabama's HB 161 set to take effect January 1, 2027, businesses face divergent compliance requirements including age verification, parental consent mechanisms, and account deletion protocols.

United StatesPrivacy

Taft, Stettinius & Hollister LLP

Tractor Supply – Compliance Takeaways From The Most Recent CCPA Settlement

On September 26, 2025, the California Privacy Protection Agency (CPPA) announced a $1.35 million fine against Tractor Supply Company, resolving allegations that the company violated the California...

United StatesPrivacy

Kelley Drye & Warren LLP

California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

United StatesPrivacy

Kelley Drye & Warren LLP

Did UPMC Data Breach Ruling Lock Plaintiffs Out Of State Court?

Scott L. Vernick was quoted in The Legal Intelligencer article, "Did UPMC Data Breach Ruling Lock Plaintiffs Out of State Court?" on January 23, 2017.

United StatesPrivacy

Fox Rothschild LLP

New Laws Target Youth-Facing AI And Online Services

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

United StatesPrivacy

Taft, Stettinius & Hollister LLP