I wonder on what the initial suspicion from the drivers was based.
Personal anecdote:
Many years ago I was involved with a US organization, and then happily forgot about it. Almost 15 years later they started spamming me with emails coming from their head office in Washington.
I asked them to stop. They didn't. I threatened legal action under GDPR and requested deletion, also under GDPR. They said they complied. A year later they started spamming me again. From the same address.
That's how I knew that they never deleted my info and kept it in the US.
The didn't slip, fall, and drop some USB flash drives into the hands of a US data processor...
I doubt it is any sort of negligence, but if it is - it's not "simple".
Most companies are negligent. Many of those are also deliberately negligent
Even worse when you move between countries and suddenly "Uber Country X" uses your account of "Country Y" to spam notify you about promotions in X. It's weird in a bad way