Dutch Regulator Fines Uber €825M Over Automated Driver Suspensions
The Dutch Data Protection Authority fined Uber €825 million for automated driver suspensions.
Why it matters: This huge GDPR fine signals growing regulatory focus on AI-driven automated enforcement impacting gig workers. Legal and privacy teams must heed the risks of insufficient human oversight in data-driven decisions.
- €825 million fine by Dutch Data Protection Authority for Uber's use of automated suspensions without human review from 2018-2022.
- Second-largest GDPR penalty, after Meta's €1.2 billion fine by Ireland in 2023.
- Uber's system failed to inform drivers of automated decision-making and lacked proper human oversight, violating EU privacy laws.
- Uber plans to appeal, asserting newer policies now include human reviews and driver appeal rights.
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) imposed a €825 million fine on Uber for its automated suspension system affecting drivers in the European Union, which operated between 2018 and 2022 without adequate human oversight. The system automatically suspended driver accounts based on algorithms, without timely human review to address potential errors or notify drivers about the automated decisions, breaching the General Data Protection Regulation (GDPR).
This penalty is significant as it represents the second-largest GDPR fine to date, following a €1.2 billion penalty imposed on Meta by Irish regulators in 2023. It marks the fourth major fine that the Dutch data watchdog has issued against Uber, which also received a €290 million fine in 2024 for improper personal data transfers to the U.S.
An Uber spokesperson stated, "We take decisions that affect drivers' ability to earn extremely seriously and we're fully committed to fair treatment. This includes human reviews, robust safeguards, and the opportunity for drivers to appeal our decisions if they believe we made a mistake." Uber has announced plans to appeal the ruling, arguing that the policies under scrutiny are outdated and that their current systems incorporate human reviews and allow drivers to challenge suspensions.
The case highlights how regulatory authorities in the EU are intensifying scrutiny on AI and automated decision-making systems in the gig economy, emphasizing the necessity to uphold transparency and human intervention. Legal compliance and data privacy teams in large corporations and law firms should monitor this evolving regulatory landscape to manage risks associated with automated enforcement technologies.
By the numbers:
- €825 million — amount fined to Uber by Dutch Data Protection Authority for GDPR violations
- €1.2 billion — largest GDPR fine issued to date, levied against Meta by Irish regulators in 2023
- €290 million — previous fine on Uber in 2024 related to improper data transfers to the U.S.
Yes, but: Uber contends the fined policies are outdated and that their current systems do include human review and allow drivers to appeal, which may influence the outcome of the planned appeal.
What's next: Uber’s appeal of the €825 million fine is pending, which may clarify future enforcement requirements around automated decision-making in the EU.