The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) has issued an 825 million euro ($966 million) fine against Uber Technologies for terminating and suspending driver accounts through automated algorithmic systems without adequate transparency or meaningful human review.
The ruling marks the second-largest regulatory penalty ever levied under the European Union's General Data Protection Regulation (GDPR), trailing only the 1.2 billion euro fine imposed on Meta in 2023 by the Irish Data Protection Commission.
Algorithmic Decision-Making and Article 22 Violations
Under GDPR Article 22, individuals retain the right not to be subjected to decisions based solely on automated processing if those determinations produce significant legal or livelihood effects. The Dutch regulator concluded that because drivers rely on platform access for income, automated suspensions and deactivations qualify as substantial interventions that demand procedural safeguards.
The investigation originated from complaints filed by drivers in France covering account actions taken between 2020 and 2022. The Dutch AP served as the lead supervisory authority because Uber operates its European headquarters in Amsterdam.
According to the regulator's findings, Uber deployed automated detection algorithms to flag suspected fraud, including instances where drivers allegedly took unnecessary route detours to inflate metered fares or accepted rides without completing trips. In addition, the AP stated that certain drivers with lower customer ratings experienced permanent deactivations initiated directly by software rather than human review. The regulator concluded that Uber failed to provide adequate notice regarding why actions were taken or maintain an effective mechanism for drivers to contest algorithmic determinations.
Uber Response and Appeal
Uber announced plans to appeal the penalty in Dutch courts, stating that it does not execute permanent account deactivations through automated systems alone without human intervention.
"We strongly disagree with this decision and disproportionate fine," an Uber spokesperson said. The company noted that current operational policies incorporate human review stages and formal dispute procedures for suspended workers.
To argue that the penalty is out of proportion to actual platform outcomes, Uber disclosed that low customer ratings resulted in 126 account terminations across Europe in 2021. The AP has not published the total number of temporary or permanent account actions initiated by its automated systems during the multi-year investigation window.
Escalating Regulatory Enforcement
The 825 million euro penalty represents the fourth and largest administrative fine imposed on Uber by the Dutch data protection watchdog:
- 2018: 600,000 euros for delayed disclosure of a data breach.
- Early 2024: 10 million euros for deficiencies in driver data access requests.
- August 2024: 290 million euros for cross-border transfers of European driver data to US servers without adequate contractual safeguards.
The decision establishes a critical regulatory precedent for platforms relying on automated decision-making and algorithmic management to govern independent contractors, reinforcing that workforce deactivations require verifiable human oversight under European data protection laws.
