Why Uber Was Fined €825 Million Over Automated Driver Deactivations

Uber’s €825 million fine is not about a data breach. The Dutch Data Protection Authority, known as the AP, said Uber used automated systems to suspend or deactivate European drivers without adequately informing them that automated decision-making was involved or giving them a meaningful opportunity for human review and challenge. The decision covers conduct from 2020 to 2022. 136

What triggered the fine

The case centered on how Uber used software to make account decisions affecting drivers’ ability to work on the platform. According to reporting on the AP’s decision, the systems were used against drivers suspected of fraud and drivers with low customer ratings. 24

The suspected-fraud scenarios included signals such as unusually long trips, which could suggest unnecessary detours intended to increase fares, and accepted rides that a driver allegedly did not intend to complete. The available reporting supports these as examples of the behavior Uber’s systems were designed to detect, but it does not independently establish that every flagged driver committed those acts. 41719

The regulator’s concern was therefore both about the decisions and the process behind them. A suspension or deactivation can significantly affect a driver’s ability to earn income. The AP said drivers were not properly told about the automated decision-making and did not receive adequate human involvement or an effective route to contest the outcome. 356

The GDPR issue: significant decisions cannot simply disappear into an algorithm

The GDPR restricts decisions based solely on automated processing when they produce legal or similarly significant effects. Where automated systems are used in circumstances covered by those protections, safeguards can include meaningful human intervention and the ability to challenge the decision. 34

That is the legal significance of the Uber case. The dispute is not simply whether software may identify suspicious activity. It is whether a platform can allow an automated process to determine that a driver should lose access to work without clear notice, genuine human review, and a practical way to seek reconsideration.

The penalty would rank as the second-largest issued under the GDPR, behind Ireland’s €1.2 billion fine against Meta in 2023. Meta’s penalty concerned the transfer of European Facebook users’ data to the United States, so the two cases involve different alleged violations even though both demonstrate the scale of European data-protection enforcement. 3614

Uber’s response

Uber disputes the AP’s conclusions and has called the fine disproportionate. The company’s position is that its systems were lawful and subject to human oversight rather than being wholly automated. That directly conflicts with the regulator’s characterization of the suspension and deactivation process. 67

Uber has also argued that relatively few drivers were deactivated for low customer ratings: Reuters reported the company’s figure of 126 European drivers in 2021. That number is presented as Uber’s argument about the scale of the conduct, not as an independently established finding in the available source material. 89

The disagreement leaves two questions for any appeal: how much human involvement actually occurred in the relevant decisions, and whether that involvement met the GDPR’s standard for meaningful review. The supplied reporting does not establish how a court or appeals process will resolve those issues.

Why the Netherlands handled a case involving European drivers

The matter began with complaints from drivers, including a complaint in France, but it was handled by the Dutch AP. Reporting identifies the case as a cross-border GDPR matter involving Uber’s European operations. 1720

The available source material does not provide enough detail to state definitively why the Netherlands served as the lead authority, so it is safer not to reduce the jurisdictional question to a single unverified explanation. What is clear is that the AP investigated the European account decisions and issued the penalty concerning the 2020–22 period. 1320

What happens next

Uber has said it will appeal. That means the €825 million decision is not necessarily the final amount the company will pay. 679

Affected drivers could also pursue compensation claims if they can establish an unlawful GDPR infringement, a connection between that infringement and their suspension or deactivation, and specific financial loss. The available evidence does not show that compensation has been awarded, nor does it establish that any future claims will succeed.

The broader lesson is narrower—and more consequential—than the headline figure: platforms may use automated systems to detect suspected abuse, but decisions that materially affect a person’s livelihood require transparency and safeguards that people can actually use. Uber’s appeal will test how those requirements apply when a company says algorithms identify risks but humans remain involved somewhere in the process.