Uber headquarters, 1455 Market St., San Francisco

Ride-hailing company Uber Technologies Inc. has been hit with more than $1 million in fines over its cover up of a 2016 breach that exposed 57 million customers' personal data—a penalty that could have been higher under the May 2018 implemented General Data Protection Regulation.

San Francisco-based Uber's latest fines, which totaled a combined $1.17 million, came from the U.K. and the Netherlands. On Tuesday, the U.K.'s Information Commissioner's Office announced it fined Uber £385,000 ($491,824). In a press release, the ICO said Uber failed “to protect customers' personal information during a cyber attack” and that 82,000 U.K.-based drivers were impacted.

Britain's ICO said the breach was caused by “avoidable data security flaws” and that the incident was a breach of the country's Data Protection Act 1998.

“This was not only a serious failure of data security on Uber's part, but a complete disregard for the customers and drivers whose personal information was stolen. At the time, no steps were taken to inform anyone affected by the breach, or to offer help and support. That left them vulnerable,” said ICO Director of Investigations Steve Eckersley in a statement.

The Dutch Data Protection Authority announced its own separate fine of €600,000 ($676,563) the same day. It said Uber violated the Dutch data breach regulation and was “fined because it did not report the data breach to the Dutch DPA and the data subjects within 72 hours after the discovery of the breach.” According to a press release Tuesday, 174,000 Dutch citizens were impacted by the breach.

News of Uber's 2016 breach emerged in November 2017. The company's new leadership under current CEO Dara Khosrowshahi revealed hackers had accessed names, email addresses and cellphone numbers of users and the names and U.S. driver's license numbers of Uber drivers in a 2016 data breach.

The company had failed to notify users of the breach at the time, instead paying the hackers $100,000 to keep quiet about the attack.

“Paying the attackers and then keeping quiet about it afterward was not, in our view, an appropriate response to the cyber attack,” Eckersley said. ”Although there was no legal duty to report data breaches under the old legislation, Uber's poor data protection practices and subsequent decisions and conduct were likely to have compounded the distress of those affected.”

Under the European Union's GDPR law, which went into effect in May of this year, Uber could have faced larger fines. Companies with breaches after the implementation date could be fined up to 4 percent of global turnover. The ICO said, that under previous law, the maximum U.K. fine was £500,000 ($638,725).

Uber did not respond to immediate request for comment but told CNBC in a statement that, “We've made a number of technical improvements to the security of our systems both in the immediate wake of the incident as well as in the years since. We've also made significant changes in leadership to ensure proper transparency with regulators and customers moving forward.”