In August 2026, the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (“AP”), fined Uber €824,990,000 for making fully automated decisions to deactivate drivers’ accounts.[1]

This is the second largest fine issued under the General Data Protection Regulation (“GDPR”) to date. The largest remains the €1.2 billion fine imposed on Meta by Ireland’s Data Protection Commission in 2023.

Background  

Between 2018 and 2022, Uber used software to monitor drivers’ behaviour and their customer ratings. Where the software detected suspected fraud (including unnecessary detours and accepting journeys with no intention of completing them) or low ratings, drivers’ accounts were deactivated automatically. Deactivation was temporary in most cases and permanent where ratings stayed low. While their accounts were deactivated, drivers lost their income from Uber, and no human assessed the decision first.

The investigation began after 171 French drivers contacted a French human rights organisation which complained to the French regulator on the drivers’ behalf. Because Uber’s European headquarters are in Amsterdam, the case was dealt with by the AP.

Findings

The AP considered the account deactivation to have a similarly significant effect on drivers because it prevented them from accessing work opportunities and earning income through the platform.

The AP found that Uber had:

1. Violated the GDPR’s ban on fully automated decision-making with legal or similarly significant effects (Article 22), because drivers’ accounts were deactivated without meaningful human involvement, notwithstanding the significant impact such decisions could have on their ability to earn a living
2. Failed to give drivers enough information about the automated decision-making.

Uber has appealed the fine, and there is no final judicial decision yet.

Key Takeaway

The decision is an unusually forceful application of Article 22 GDPR, which gives individuals the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects on them. Where an Article 22 exception applies, controllers must still allow individuals to obtain human intervention, give their point of view and contest the decision.[2] Telling people in advance how automated decisions are made is a separate obligation from human review, and failing to do so was a distinct finding against Uber.

The decision is a reminder that a human review process must be genuine and substantive. Simply providing a mechanism for a person to review an automated decision after it has been implemented may not be sufficient if the reviewer merely rubber-stamps the output of the system. Organisations relying on automated decision-making should ensure that appropriately trained personnel have authority to meaningfully assess and, where appropriate, overturn automated outcomes.