The Dutch Data Protection Authority has hit Uber with its largest privacy penalty to date, and according to SecurityAffairs, this time the issue is not cross-border data flows or cookie banners. The regulator imposed a fine of 825 million euros, around $964 million, over Uber's practice of using software-only decision systems to deactivate driver accounts, in some cases permanently, without any human checking the outcome.
The breach sits squarely inside EU privacy law. The GDPR restricts fully automated decisions when they have a significant effect on a person's life. A system that can strip away someone's livelihood without a human reviewer clearly falls into that restricted category. The Dutch authority also concluded that Uber failed to properly tell drivers that automated systems were making these calls, which the regulation explicitly requires.
What Uber actually did
According to the Dutch authority, Uber relied on software to monitor driving behaviour and customer ratings. When the system flagged suspected fraud or scores that fell below a threshold, affected drivers were deactivated automatically, either temporarily or, after sustained low ratings, for good. No human ever assessed those cases. The conduct ran from 2018 to 2022.
Uber has ended the offending practices, the regulator said. The company is mounting a legal challenge to both the ruling and the financial penalty, contending that the watchdog was reviewing long-discontinued systems rather than current operations. Uber also pointed to existing human review, safeguards and a driver appeals process, though the challenge will need to clarify whether those protections were in place during the years the fine covers.
A pattern with one regulator
This is the fourth penalty the Dutch authority has issued against Uber. The previous high-water mark was a 290 million euro penalty issued in 2024 over moving European drivers' personal data to the United States without proper safeguards, which Uber also contested. Four penalties from a single supervisor in quick succession is not bad luck. It is a recurring disagreement over the same underlying question: how much human oversight must sit between an algorithm's verdict and a worker's pay.
What this means for you
For any platform leaning on automation to manage workers, customers or account status, this ruling puts a price tag on "the algorithm decided." Saying nothing more is no longer acceptable when income or access is on the line.
For drivers hit by past suspensions, the fine does not automatically reverse them. A driver who believes a software-only ruling cost them income should still use Uber's appeals route and, where appropriate, file a complaint with the Dutch authority, since the regulator also found Uber failed to inform drivers about automated decision-making.
Our analysis
The interesting point is what the GDPR actually demands. It does not ban automated decisions outright; it bans fully automated decisions with significant impact when no human is in the loop and no meaningful challenge is possible. Uber's defence, that human review and appeals now exist, is exactly the bar every company in a similar position must clear. The regulator's question is not "do you mention humans somewhere in your policy?" but "did a human weigh this specific case and could they have reached a different result?"
The €825 million figure also signals how seriously the Dutch supervisor treats this category. Past penalties from the same office were large but smaller. The jump reflects both the four-year duration and the direct hit to drivers' earnings. Other platforms should not assume that generic human-review language in terms of service will satisfy the watchdog; the bar appears to be shifting toward documented, case-by-case human intervention.
The gig-economy angle stretches well beyond Uber. Numerous platforms in Europe use algorithmic systems to manage workers, dispatch routes and decide account status. This decision puts a clear cost on skipping human oversight. For any business making algorithmic calls about income or access, the next regulatory move is now fairly predictable.
A worked example
Say you are a trust-and-safety lead at a gig-economy platform operating in the EU, and your team wants to launch an automated suspension system for drivers whose ratings drop below a threshold. Your product manager argues that human review will not scale and that the model is accurate.
What this ruling tells you to do: do not ship a fully automated suspension that touches income. Insert a human-review step into the decision path, with evidence that a person actually considered the specific case. Tell drivers, plainly, that automated decision-making is in play. Offer a genuine appeal route that ends in a human outcome, not another automated re-check. If you cannot deliver all three, you are signing up for the regulatory and reputational exposure Uber is now carrying.
What to watch next
Expect Uber's appeal to grind through Dutch courts and possibly EU-level proceedings over several years. Keep an eye on whether rival gig-economy platforms quietly rewrite their terms of service, and on whether the Dutch authority's next action targets another sector or another mobility player. If your platform makes automated decisions that affect pay, this ruling is now the benchmark you will be measured against.
Key takeaways
- Fully automated decisions that affect income require meaningful human review under GDPR; the algorithm alone is not enough.
- Companies must clearly inform users when automated decision-making is in use; Uber's failure to do so was a separate violation.
- The €825 million fine reflects both the duration of the conduct and the direct impact on drivers' livelihoods.
- Existing human-review language in terms of service is not enough; regulators want demonstrable, case-by-case human intervention.
Frequently asked questions
Why was Uber fined?
For using fully automated software to suspend drivers' accounts without human review between 2018 and 2022, in violation of GDPR rules on automated decision-making.
How large is the fine?
€824,990,000, roughly $964 million, the largest privacy fine Uber has received from the Dutch regulator.
Does the fine cover current Uber practices?
No, it covers systems from 2018 to 2022 that Uber says it has since changed. The Dutch authority says Uber has stopped the violations.
Is Uber appealing?
Yes. Uber has stated it disagrees with the ruling and the size of the penalty.
What is the broader impact?
Other gig-economy platforms that rely on automated decisions to manage workers now face a clearer benchmark for what GDPR compliance actually requires.
Source: securityaffairs.com