Uber fined 825 million euros for suspending drivers by algorithm, without a human in the loop
The Dutch Data Protection Authority has fined Uber 825 million euros, the second-largest GDPR penalty on record, for suspending drivers' accounts through automated systems without meaningful human review and without telling them. Uber will appeal and disputes the regulator's account of the facts. The provision at the centre of the case is the GDPR's rule that decisions which significantly affect a person cannot be left to software alone.
What happened
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) has fined Uber 825 million euros, about 966 million dollars, for suspending driver accounts through automated systems without meaningful human involvement and without properly informing the drivers. Reuters reported the decision on 21 August after reviewing a document dated 17 August. The AP confirmed the decision but has not published its full text, and neither has Uber.
It is the second-largest penalty ever issued under the General Data Protection Regulation, behind only the 1.2 billion euros the Irish regulator imposed on Meta in 2023 for unlawfully transferring European Facebook users' data to the United States.
What Uber's systems were doing
Between 2020 and 2022, Uber's software temporarily suspended the accounts of drivers in Europe that it flagged for suspected fraud, for example concluding that a driver had taken an unnecessary detour to inflate a fare, or had accepted trips they did not intend to complete. The AP found that in some cases drivers with low customer ratings were removed permanently.
The regulator's objection is not that Uber acted against fraud. It is that a decision with a significant effect on a person, here the loss of the ability to earn a living, was reached by an algorithm without the human involvement and the route to challenge it that the GDPR requires. The relevant provision, Article 22, gives people the right not to be subject to a decision based solely on automated processing where it significantly affects them.
The AP has determined that Uber violated drivers' rights, specifically the right not to be subject to automated decision-making that has significant consequences.
The decision added that Uber "also violated the right to be informed."
The case began with a complaint from drivers in France. The AP led the investigation because Uber's European headquarters are in Amsterdam, which makes it Uber's lead data-protection authority across the EU. It is the fourth and largest in a run of Dutch fines against the company, following penalties of 600,000 euros in 2018, 10 million euros in early 2024, and 290 million euros later in 2024 over transfers of driver data to the United States.
Uber's response
Uber said it will appeal and called the fine "disproportionate." It disputes the regulator's central factual claim, saying it has never permanently deactivated an account through automated systems alone, that suspensions were usually brief, and that its current policies include human review and a way for drivers to contest a suspension. The company said low customer ratings cost 126 drivers their accounts across Europe in 2021. The AP has not published a total figure for how many drivers the automated suspensions affected.
Why it matters
The following is analysis.
The provision Uber was found to have breached is close to a legal statement of a principle worth taking seriously as a design rule rather than a slogan: a system may inform a consequential decision about a person, but a human has to stay meaningfully in the loop, and the person has to be told and be able to object. The size of the fine signals that a regulator is willing to treat the absence of that human step as a serious harm in its own right, separate from whether the underlying fraud calls were right or wrong.
Two cautions belong with the number. The facts are contested: the AP and Uber disagree about whether software ever removed a driver permanently on its own, and that disagreement is exactly what an appeal would test. And headline GDPR fines against large technology companies have a history of shrinking or being overturned on appeal, sometimes years later. The 825 million euros is where the case starts, not necessarily where it ends.
What to watch
Whether Uber files its appeal and on what grounds, whether the AP publishes the full decision, and whether its reasoning on automated decisions about workers is picked up by other regulators. The question of what a piece of software may decide about a worker on its own is not confined to ride-hailing.