What do Uber's Illegal Cross-Border Data Transfers show about Data Subject Rights under the GDPR, and could it do more to protect these?
| Pages | 44-57 |
| Date | 01 June 2026 |
| Published date | 01 June 2026 |
| Author | Shaan Jalaly |
| Subject Matter | Social Sciences |
Southampton Student Law Review
Volume 16, Issue II Autumn 2026
44
ARTICLE
What do Uber’s Illegal Cross-Border Data Transfers
show about Data Subject Rights under the GDPR, and
could it do more to protect these?
SHANN JALALY†
University of Southampton
ABSTRACT. This article seeks to explore the extent to which the GDPR sufficiently
supports data subjects in obtaining compensation and redress for harms suffered by GDPR
breaches. It first considers the relevant legal and normative framework of data protection
under the GDPR, it then discusses the specific facts of this case including Uber’s
wrongdoing. This is followed by discussion of data subject rights under the GDPR. It then
analyses the potential forms of harm that could have been caused in this case, and how the
GDPR could potentially adopt a dualistic role in enforcement, where it focuses on
punishing data processors and assisting data subjects in claiming compensation.
Table of Contents
Introduction ....................................................................................................................... 44
1. Applicable Legal Framework ..................................................................................... 45
2. Factual Background of the Uber Case Study ............................................................. 48
3. Disputed Legal Issues of this Case Study .................................................................. 48
4. Analysis of the Fine .................................................................................................... 50
5. The rights of data subjects .......................................................................................... 52
6. Harm Arising from these Unlawful Transfers ............................................................ 53
7. The GDPR’s Compensation Framework .................................................................... 54
Conclusion ........................................................................................................................ 56
Introduction
his article analyses the 2024 decision of the Dutch Data Protection Authority,
the Autoriteit Persoonsgegevens (the AP), regarding Uber’s unlawful cross-
† Final Year LLB at University of Southampton (Hons). Thank you to my lecturers for this
module, Dr Napoleon Xanthoulis and Dr Stephanie Law for prompting my interest here.
T
Get this document and AI-powered insights with a free trial of vLex and Vincent AI
Get Started for FreeStart Your Free Trial of vLex and Vincent AI, Your Precision-Engineered Legal Assistant
-
Access comprehensive legal content with no limitations across vLex's unparalleled global legal database
-
Build stronger arguments with verified citations and CERT citator that tracks case history and precedential strength
-
Transform your legal research from hours to minutes with Vincent AI's intelligent search and analysis capabilities
-
Elevate your practice by focusing your expertise where it matters most while Vincent handles the heavy lifting
Start Your Free Trial of vLex and Vincent AI, Your Precision-Engineered Legal Assistant
-
Access comprehensive legal content with no limitations across vLex's unparalleled global legal database
-
Build stronger arguments with verified citations and CERT citator that tracks case history and precedential strength
-
Transform your legal research from hours to minutes with Vincent AI's intelligent search and analysis capabilities
-
Elevate your practice by focusing your expertise where it matters most while Vincent handles the heavy lifting
Start Your Free Trial of vLex and Vincent AI, Your Precision-Engineered Legal Assistant
-
Access comprehensive legal content with no limitations across vLex's unparalleled global legal database
-
Build stronger arguments with verified citations and CERT citator that tracks case history and precedential strength
-
Transform your legal research from hours to minutes with Vincent AI's intelligent search and analysis capabilities
-
Elevate your practice by focusing your expertise where it matters most while Vincent handles the heavy lifting
Start Your Free Trial of vLex and Vincent AI, Your Precision-Engineered Legal Assistant
-
Access comprehensive legal content with no limitations across vLex's unparalleled global legal database
-
Build stronger arguments with verified citations and CERT citator that tracks case history and precedential strength
-
Transform your legal research from hours to minutes with Vincent AI's intelligent search and analysis capabilities
-
Elevate your practice by focusing your expertise where it matters most while Vincent handles the heavy lifting
Start Your Free Trial of vLex and Vincent AI, Your Precision-Engineered Legal Assistant
-
Access comprehensive legal content with no limitations across vLex's unparalleled global legal database
-
Build stronger arguments with verified citations and CERT citator that tracks case history and precedential strength
-
Transform your legal research from hours to minutes with Vincent AI's intelligent search and analysis capabilities
-
Elevate your practice by focusing your expertise where it matters most while Vincent handles the heavy lifting
