Dutch Regulator Fines Uber $966M for Automated Driver Deactivations With No Human Review
The Dutch Data Protection Authority (AP) fined Uber €825 million ($966 million) under GDPR, citing automated driver account suspensions — some permanent — made without adequate disclosure or human oversight. The decision, issued August 17, is the largest enforcement action targeting automated decision-making under European data protection law.
Reuters reviewed the decision exclusively. The AP found that Uber’s algorithms deactivated driver accounts, including permanently, without adequately informing drivers that automated systems were making the determination or that they had a right to contest it. No mechanism existed for a human to review automated suspension decisions for errors before they took effect.
What GDPR Requires
Article 22 of the GDPR gives individuals the right not to be subject to decisions based solely on automated processing when those decisions produce significant effects. Companies relying on automated systems to make such decisions must: disclose that automated processing is being used, explain the logic involved, and provide a pathway for human review.
Uber’s systems failed on both disclosure and human review. Drivers whose accounts were deactivated — in some cases losing their primary income — had no effective mechanism to trigger review or understand why the decision was made.
Why the Number Is So Large
GDPR maximum penalties are calculated as a percentage of global annual turnover. At €825 million, the AP is asserting that Uber’s violations were serious, sustained, and affected a large number of individuals across a jurisdiction where the company operates at scale. The fine exceeds prior GDPR automated-decision enforcement actions by a substantial margin.
Uber has contested previous European data protection findings in multiple jurisdictions. Whether the company will appeal the AP decision has not been confirmed in published reporting.
The Precedent
The decision arrives as automated systems handle increasingly consequential decisions for gig and contract workers: account suspension, task allocation, performance scoring, insurance eligibility. The ruling establishes that automated pipelines producing significant effects on individuals require human oversight mechanisms — even when a company’s business model depends on the speed and scale of automated processing.
The cost-benefit calculus has now been priced. At €825 million, human review is cheaper than the alternative.