Uber Hit With €825M GDPR Fine Over Automated Driver Decisions

Introduction

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) has issued Uber a fine of €824.99 million - roughly €825 million - over how the company used automated systems to make decisions about driver accounts. The size of the penalty alone makes the case significant. It also puts a spotlight on a core GDPR rule that many organisations still treat as secondary: protections around automated decision-making that can seriously affect people.

This case is not simply about whether a company may use algorithms. It centres on automated decisions that could temporarily or permanently cut drivers off from the platform - and therefore from their ability to earn a living. When software can decide whether someone keeps access to work, the legal and ethical stakes rise quickly.

Why Uber Was Fined

According to the regulator, problems with Uber’s use of automated decision-making ran from 2018 to 2022. Uber’s software could automatically start temporary or permanent account deactivations based on algorithmic signals. Those signals reportedly included factors such as:

• Trip length
• Route detours
• Fraud-related signals
• Customer review thresholds

For drivers, the outcome of those processes was not abstract. Losing access to the app can mean losing income overnight. That real-world impact is central to why automated account decisions attract close regulatory attention under the GDPR.

GDPR Article 22 and Automated Decision-Making

GDPR Article 22 is often summarised in simple terms: people have protections against decisions based solely on automated processing when those decisions produce legal effects or similarly significant effects on them.

In practice, that means organisations cannot casually hand high-impact outcomes entirely to software. If a decision can change someone’s legal position, access to a service, or ability to work and earn, the GDPR expects stronger safeguards - including meaningful human involvement in many cases.

A practical example makes the point clear. If an algorithm flags a driver for fraud and automatically removes their access to work, the driver should have a meaningful way to have that decision reviewed by a person. A rubber-stamp process that never questions the model is not the same as real human oversight.

The Human Oversight Problem

Human review sits at the centre of this debate. The regulatory concern was not merely that Uber used algorithms. It was that important account decisions could be made through automated systems without sufficient human intervention.

There is an important difference between:

• Automated decision-making - the system largely decides the outcome with little or no real human role.
• AI-assisted decision-making with meaningful human review - software may flag, score, or recommend, but a person can examine the case, question the result, and change the outcome.

Meaningful oversight is more than ceremony. An employee simply clicking “approve” after an algorithm makes a decision should not be treated as meaningful human oversight. Human review should include a real ability to examine the facts, challenge the model’s conclusion, and reverse or amend the result when needed.

Transparency and Profiling

The regulator also raised concerns about transparency. Under the GDPR, companies need to explain clearly when automated decision-making and profiling are being used - especially when the stakes for individuals are high.

People affected by significant automated decisions should not be left guessing about basic questions:

• What information was used?
• Why was the decision made?
• Was an algorithm involved?
• How can the decision be challenged?
• Can a human review the decision?

Without clear answers, individuals cannot exercise their rights effectively. Transparency is not a marketing layer on top of a product; it is part of lawful and accountable processing.

How the Investigation Started

The investigation did not begin in isolation. It followed complaints from 171 drivers in France, brought through Ligue des droits de l’Homme (LDH) and involving the French data protection regulator, CNIL.

Because Uber’s European headquarters are in Amsterdam, the Dutch Data Protection Authority led the cross-border investigation under the GDPR’s one-stop-shop system. That structure is designed so one lead supervisory authority coordinates cases that span multiple EU countries - a common pattern for large platforms operating across Europe.

Why the €824.99M Fine Matters

The fine is approximately €825 million. It is reported as the second-largest GDPR penalty ever issued, behind Meta’s €1.2 billion penalty in 2023.

The scale matters for any business using AI and automated systems. The message is broader than one company or one product team. Regulatory risk is not limited to how an AI model works internally. It also includes how the system affects people, how decisions are reviewed, and whether the company can explain and defend those decisions when challenged.

For boards and product leaders, the case is a reminder that governance, documentation, and human process design are part of compliance - not optional extras after launch.

Uber's Response

Uber has said it intends to appeal the decision. The company considers the fine disproportionate and argues that it relates to legacy policies discontinued years ago. Uber’s position also includes the claim that current processes include human reviews and ways for drivers to dispute decisions.

Those statements reflect Uber’s position, not established findings of fact. The regulator’s decision and Uber’s appeal arguments should be kept distinct. Until appeals and any further proceedings conclude, the public record includes both the authority’s conclusions and the company’s disagreement with them.

What Companies Using AI Should Learn From the Uber Case

Organisations that rely on algorithms for operational decisions can take practical lessons from the case:

• Identify decisions that can significantly affect people
• Determine whether automated processing is making or influencing those decisions
• Build meaningful human review into high-impact decisions
• Keep clear records of how decisions are made
• Give affected individuals a meaningful way to challenge decisions
• Be transparent about profiling and automated decision-making
• Review legacy AI systems and policies for current compliance
• Treat AI governance, privacy, and accountability as part of product design rather than as an afterthought

Broader AI Governance Lesson

As companies use algorithms to make decisions about workers, customers, applicants, borrowers, or other individuals, regulators are increasingly focused on the real-world impact of those systems. Accuracy alone is not enough when the outcome can change someone’s livelihood or rights.

The bigger lesson is simple: when an algorithm can significantly affect a person's rights, income, or access to work, companies need more than an accurate model. They need meaningful human oversight, transparency, accountability, and a clear process for challenging decisions.