Dutch regulator fines Uber $966m for automating driver suspensions
The Dutch Data Protection Authority has fined Uber €825m ($966m) for deactivating drivers' accounts using automated systems without adequately informing them or allowing meaningful human review, in a decision dated 17 August. It is the second-largest penalty ever issued under the EU's GDPR, behind only a €1.2bn fine imposed on Meta by Ireland in 2023, and reflects a wider pattern of European regulators levying billions of euros in penalties against major US technology firms over privacy, competition and digital markets rules. Uber has said it will appeal, arguing the fine is disproportionate and that its processes include human review and avenues for drivers to dispute suspensions.
The regulator found that Uber breached GDPR rules banning decisions made solely by algorithms when they significantly affect people's lives, citing cases from 2018 to 2022 in which drivers suspected of fraud were suspended and some with low customer ratings were permanently deactivated by computer without warning. Uber disputed the latter claim, saying permanent deactivations were never fully automated, and noted that only 126 drivers in Europe were deactivated over low ratings in 2021. The case originated from a French complaint but was handled by the Dutch authority, as Uber's European headquarters are in the Netherlands; digital-rights group PersonalData.IO, which supported the original complainants, is now preparing a related class action.
- Dutch regulator fined Uber €825m ($966m) over automated driver suspensions
- Second-largest GDPR fine ever, after a 2023 Meta penalty
- Uber plans to appeal; case stems from 2018-2022 incidents
New here? Start with this
Uber is a ride-hailing company whose app connects passengers with drivers. Drivers depend on access to the app for work, so suspending or closing an account can have a serious effect on their income.
The EU’s General Data Protection Regulation (GDPR) sets rules for how organisations use personal data. It restricts decisions made entirely by automated systems when they significantly affect people, and gives people rights to information and a meaningful chance to challenge such decisions.
Uber’s European headquarters are in the Netherlands, so the Dutch Data Protection Authority handled a complaint brought by drivers in France. The case sits within wider scrutiny of how large technology companies use personal data and make decisions that affect people.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Advocates of the fine argue that gig-economy workers deserve meaningful human oversight when algorithms can end their livelihood at a keystroke, and that GDPR rules requiring clear explanation and the right to contest automated decisions exist precisely to prevent opaque systems from operating unchecked. They see this as a necessary check on corporate power, ensuring companies cannot hide behind "the algorithm did it" when suspending someone's income without adequate warning or a fair appeals process. A penalty of this size, they contend, is proportionate to Uber's global revenue and is the only language large multinationals reliably respond to.
The case against
Critics of the fine argue that platforms like Uber must be able to act swiftly against fraud, safety violations or rule-breaking at scale, and that automated systems are essential to managing millions of drivers efficiently and consistently. They see the penalty as disproportionate and emblematic of European regulators using vague standards to extract enormous sums from US tech firms, creating legal uncertainty that could discourage innovation and investment in the region. They also note that some human review already exists in Uber's process, and that a near-billion-dollar fine risks punishing the company far beyond any actual harm caused to affected drivers.