Uber Hit With €825M GDPR Fine Over Automated Driver Suspensions in Netherlands

TL;DR

• The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has fined Uber €825 million for using fully automated systems to suspend and deactivate drivers without meaningful human review, the second-largest GDPR fine ever after Meta's €1.2 billion penalty.
• Regulators found the system violated Article 22 of the GDPR, which protects individuals from decisions based solely on automated processing, as well as transparency and fairness obligations, after drivers were locked out of the app with little explanation or recourse.
• The landmark ruling sets a major precedent for the gig economy and AI governance in Europe, signaling stricter enforcement against algorithmic management and automated decision-making in the workplace.

What Happened: A Record Fine for Uber in the Netherlands

The Dutch Data Protection Authority has delivered one of the harshest penalties in the history of European privacy law. On Monday, the regulator announced an €825 million fine against Uber over its handling of driver accounts in the Netherlands and across the EU.

The fine, which equates to nearly $1 billion, is the second-largest ever issued under the General Data Protection Regulation, trailing only the €1.2 billion fine levied against Meta in 2023 for transatlantic data transfers. It also dwarfs Uber's previous GDPR penalty from the same authority — a €290 million fine in 2024 over improper transfer of driver data to the United States.

This time, the issue was not where the data went, but how it was used to make high-stakes decisions about people's livelihoods.

How Uber's Automated Deactivation System Worked

At the center of the investigation was Uber's automated system for flagging and deactivating drivers. According to the regulator, Uber relied on algorithms to monitor driver activity, including fraud detection signals, customer complaints, trip cancellations, account verification checks, and other risk indicators.

When the system detected a potential violation, it could automatically trigger a temporary suspension or a permanent deactivation, immediately cutting off a driver's access to the platform and their source of income. Drivers were often notified with a generic in-app message citing a violation of community guidelines or terms of service, without specific details about what triggered the decision.

An investigation launched after complaints from drivers and drivers' rights groups found that in a significant number of cases, there was no meaningful human intervention before the account was disabled. While Uber argued that human staff were available to review appeals, the Authority concluded that the initial, consequential decision was made solely by automated means.

Why Regulators Say It Violated the GDPR

The core of the Dutch Authority's case rests on Article 22 of the GDPR, which gives individuals the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects.

Regulators determined that losing access to the Uber platform clearly meets that threshold, as it directly impacts a driver's ability to earn a living. Under Article 22, such automated decisions are generally prohibited unless the company has explicit consent, a contractual necessity, or authorization under EU law, and even then must implement suitable safeguards.

The Authority ruled that Uber failed on three key fronts:

First, it carried out solely automated decision-making with significant effects without a valid legal basis. Second, it failed to provide adequate transparency, as drivers were not clearly informed that they were subject to automated decision-making, how the logic worked, or what factors led to their suspension. Third, it did not provide sufficient safeguards, including the right to obtain human intervention, to express their point of view, and to contest the decision before it took effect.

In essence, regulators said Uber built a system where the algorithm acted as judge, jury, and executioner, with human review only available as an afterthought.

Uber's Response and Next Steps

Uber has said it will appeal the decision. In a statement, the company said it believes its processes comply with European law and that human reviewers are involved in its safety and fraud systems. The company has also argued that automated tools are necessary to operate safely at scale and to protect passengers and the integrity of the platform.

Uber has the option to appeal to the District Court in the Netherlands and could seek to have the fine suspended during proceedings, a process that could take years. The company will also be required to change its deactivation processes to bring them into compliance, including ensuring meaningful human review before any suspension that significantly affects a driver and providing clearer explanations to drivers.

The Authority has given Uber a set period to reform its systems or face additional periodic penalty payments on top of the fine.

A Landmark Moment for the Gig Economy and AI Governance

Beyond Uber, the ruling sends a shockwave through the entire gig economy and the broader AI industry. Platform companies including delivery, ride-hailing, and freelance services have increasingly relied on algorithmic management to oversee millions of workers — assigning jobs, setting pay, evaluating performance, and disciplining or deactivating accounts.

This decision makes clear that European regulators view the management of workers through opaque algorithms as a high-risk privacy and labor issue, not just an operational efficiency.

For other gig platforms operating in the EU, the message is blunt: you cannot automate firings. Any system that makes significant decisions about workers must have a human in the loop who has real authority to overturn the machine, and workers must understand how decisions are made.

The fine also arrives as the EU ramps up enforcement of both the GDPR and the new EU AI Act, which classifies AI systems used for employment and worker management as high-risk and imposes strict requirements for transparency, human oversight, and accountability. Regulators are signaling that Article 22 will be enforced aggressively as a bridge to the AI Act's broader rules.

Privacy advocates and labor groups have hailed the fine as a long-overdue victory, arguing that drivers have for years complained about being deactivated by a faceless system with no way to defend themselves. For tech companies betting big on automation and AI-driven governance, the €825 million price tag is a powerful reminder that in Europe, efficiency cannot come at the expense of fundamental rights.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.