Dutch AP fines Uber nearly €825 million over automated driver deactivations, highlighting the need for safeguards when decisions affect individuals’ livelihoods.
The Dutch data protection authority, Autoriteit Persoonsgegevens (AP), has imposed a €824,990,000 fine on Uber B.V. and Uber Technologies Inc. for automated individual decisions concerning drivers on the platform. The AP found that account deactivations were made without human involvement and significantly affected drivers’ ability to earn an income. For organisations using automated systems to manage access to work or services, the decision illustrates why the consequences for individuals must be central to compliance assessments.
The investigation followed a collective complaint by more than 170 drivers.
The case began in 2020, when the CNIL received a collective complaint from the French human rights organisation La Ligue des droits de l’Homme, representing more than 170 Uber drivers. Supplemented in 2021, the complaint raised concerns about information provided to drivers, international data transfers and automated decisions temporarily or permanently disconnecting drivers from the platform.
The latest sanction follows two earlier fines arising from those concerns: €10 million imposed on 11 December 2023 for shortcomings in information provided to drivers, and €290 million imposed on 22 July 2024 for transfers of personal data outside the European Union. The new decision addresses a separate issue: automated individual decision-making.
Account deactivations significantly affected drivers’ ability to earn an income.
The AP considered temporary deactivations triggered by suspected fraud, and temporary or permanent deactivations resulting from low customer ratings, to be automated individual decisions. Its assessment rested on the complete absence of human intervention in the decision-making process.
The effect on drivers was significant: once their accounts were blocked, they could no longer accept trips or generate income through the platform. The case therefore concerns more than an internal administrative process. A temporary restriction can have a substantial practical impact even when it does not permanently end a person’s access to the service.
Article 22 places limits on solely automated decisions with significant effects.
Article 22 GDPR establishes the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects an individual. Limited exceptions apply, including contractual necessity, authorisation by law with safeguards, or explicit consent. Where the contractual necessity or explicit consent exceptions apply, safeguards must include the ability to obtain human intervention, express a view and contest the decision.
The provision is not a blanket prohibition on automation. However, organisations must assess both how a decision is reached and what it means for the person affected. Using automated tools for fraud detection or service quality management does not remove the need to assess whether a resulting restriction falls within Article 22.
The AP led the investigation with support from the CNIL.
Uber’s main establishment in the European Union is in the Netherlands, making the AP responsible for leading the investigation under the GDPR’s cooperation arrangements. Uber B.V. is based in Amsterdam, while Uber Technologies Inc. is headquartered in San Francisco.
The AP worked closely with the CNIL during inspections, the analysis of evidence and the review of the draft decision through the GDPR’s one-stop-shop mechanism. The CNIL informed the complainants of the outcome. The procedure illustrates how a complaint submitted in one Member State can lead to coordinated enforcement involving a regulator in another.
Organisations should review how automated systems restrict access to work and services.
For businesses, the practical lesson is to examine the entire decision-making process, rather than treating a system as compliant simply because it serves a legitimate operational objective. Organisations should identify where automated scores, fraud indicators or customer ratings directly trigger restrictions and assess whether those restrictions have legal or similarly significant effects.
Where human involvement forms part of the process, it should provide a genuine opportunity to assess the relevant circumstances and change the outcome, rather than simply approve an automated recommendation. Documented decision criteria, clear information for affected individuals and accessible routes to challenge decisions can help organisations translate their data protection obligations into workable operational controls.
The size of the sanction reinforces the importance of addressing these questions before deploying or expanding automated decision-making. Privacy, legal and product teams should work together to assess the risks, determine whether a DPIA is required and ensure that safeguards remain effective as systems evolve.
Discover how Aphaia helps organisations operationalise GDPR compliance.
Managing automated decision-making requires organisations to connect legal requirements with the way their systems operate in practice. Aphaia helps organisations assess data protection risks, conduct DPIAs and develop governance measures that support accountable automation, meaningful oversight and the protection of individuals’ rights.
