Uber now faces an €824.99 million GDPR fine over automated decisions affecting drivers’ access to work. The Dutch Data Protection Authority (AP) issued the penalty with cooperation from France’s CNIL.
How Uber Suspended Drivers Through Automation
The case concerns account deactivations linked to suspected fraud and low customer ratings. The AP classified those actions as automated individual decisions because humans did not intervene in the process.
Suspended drivers could not accept rides or generate revenue. In addition, the AP said drivers did not receive adequate information about the decisions.
The investigation began with a collective complaint in France. La Ligue des droits de l’Homme represented 171 drivers. The complaint reached the AP because Uber’s European headquarters operates from the Netherlands.
The complaint covered incidents between 2018 and 2022. It also followed earlier penalties concerning driver information and transfers of personal data outside the European Union.
The Missing Human Oversight Behind the Fine
European GDPR rules restrict solely automated decisions when those decisions significantly affect people’s lives. Such decisions require meaningful human review and a way to challenge the outcome.
The AP said Uber’s systems temporarily suspended drivers suspected of fraud. Examples included alleged fare inflation through unnecessary detours and accepted trips that drivers allegedly did not intend to complete.
Furthermore, the AP said computer systems permanently deactivated some drivers with low customer ratings. Uber disputes that claim and says permanent deactivations always receive human review. Additionally, Uber says most suspensions last briefly. The company also says drivers can appeal platform decisions.
Why the €825M Penalty Matters for Global Apps
At the moment, the penalty ranks as the GDPR’s second-largest fine, behind Meta’s €1.2 billion penalty from 2023.
More importantly, the decision highlights the risks of automated account enforcement. Platforms often use software to detect fraud, assess conduct and protect users. However, the AP can object when software alone produces serious consequences.
Therefore, the ruling matters beyond ride-hailing. Any app that can remove access, income or essential services should examine its automated decisions. Companies should also provide clear explanations, meaningful review and effective appeal procedures.
Moreover, the case demonstrates another risk. A platform cannot shift responsibility to an algorithm after designing the rules, data systems, and enforcement process.
Appeals, Compensation, and Tighter Controls Ahead
Uber strongly rejects the decision and calls the fine disproportionate. Consequently, the company plans to appeal. The outcome may change after the appeals process. European authorities have imposed large fines before, but appeals sometimes reduce or reverse penalties.
Meanwhile, PersonalData.IO says it plans a class-action lawsuit seeking compensation for affected drivers. The group helped drivers collect information about the algorithmic decisions.
Ultimately, the final impact will depend on the appeal and any legal claims. Nevertheless, the case has already delivered a clear message. Global apps must keep humans accountable when automated systems make decisions with major personal consequences.
