The Autoriteit Persoonsgegevens, the Dutch data protection authority, has imposed a fine of EUR 824,990,000 on Uber for violating the General Data Protection Regulation's prohibition on fully automated decision-making1. The penalty is one of the largest GDPR fines on record and targets Uber's use of automated systems to deactivate driver accounts without adequate human oversight or sufficient disclosure.
How the systems worked
The Autoriteit Persoonsgegevens found that Uber made fully automated decisions about drivers. When the platform's systems flagged suspicions of fraud or detected customer reviews that fell below a threshold, driver accounts were automatically temporarily deactivated. In cases of persistently low customer reviews, accounts were permanently deactivated. Deactivation cut off drivers' income through the platform for the duration of the suspension or, in permanent cases, indefinitely.
The authority also ruled that Uber did not sufficiently inform drivers about the automated decision-making processes applied to their accounts, citing violations of GDPR Article 13, which governs information obligations when personal data are collected from data subjects, and Article 22, which restricts automated individual decision-making including profiling.
Origin in French driver complaints
The investigation traces to complaints filed by 171 French Uber drivers, submitted through the Ligue des droits de l'Homme to the CNIL, France's data protection authority. Because Uber's European headquarters are in the Netherlands, the case was handled by the Autoriteit Persoonsgegevens under the GDPR One-Stop-Shop procedure. The conduct at issue spanned 2018 to 2022.
ANALYSIS The fine's scale and its focus on automated account deactivation carry direct relevance for any platform that uses algorithmic systems to gate worker access. The ruling treats automated suspension of a driver's ability to earn as a decision producing legal effects, placing it squarely within GDPR Article 22's restrictions on fully automated decision-making.
Uber's broader autonomous-vehicle ambitions continue in parallel. The company recently expanded its robotaxi partnership with Pony.ai to London, where testing of Pony.ai's Gen-7 vehicles is set to begin[2].
ANALYSIS The enforcement action does not concern Uber's autonomous-vehicle operations but rather its platform-side algorithmic governance of human drivers, a distinction that nonetheless underscores regulatory attention to automated systems across Uber's business.