Dutch Regulator Fines Uber $966 Million Over Automated Driver Suspensions

The Dutch Data Protection Authority (AP) has fined Uber €825 million ($966 million) for using automated systems to deactivate driver accounts without adequate human review or notification, marking the second-largest penalty ever under the EU's General Data Protection Regulation (GDPR) Source: AP News. The fine, announced on August 21, stems from incidents between 2018 and 2022, initially reported by French drivers and handled by the Dutch regulator because Uber's European headquarters are in the Netherlands Source: The Guardian.

The violation

GDPR prohibits decisions made solely by algorithms that significantly affect individuals, requiring meaningful human involvement and a way to challenge decisions. The AP found that Uber violated drivers' rights by automatically suspending accounts suspected of fraud, such as taking unnecessary detours or accepting trips without completing them, and sometimes permanently deactivating drivers with low customer ratings without human review Source: The Next Web. Uber disputes this, stating it never automated permanent deactivations and that suspensions were usually brief Source: CNA.

Uber's response

Uber strongly disagrees with the decision, calling the fine "disproportionate" and noting that only 126 drivers were deactivated in Europe in 2021 due to low ratings Source: Engadget. The company says its current policies include human reviews and appeal opportunities, and it plans to appeal the fine Source: TechCrunch.

Context and next steps

This is the fourth fine the AP has imposed on Uber, following penalties in 2018, 2023, and 2024 Source: AP News. The largest previous fine was €290 million for data transfers to the US, which Uber is also appealing Source: The Next Web. Swiss digital-rights group PersonalData.IO, which helped drivers bring the complaint, is preparing a class action lawsuit against Uber Source: TechCrunch.