Enforcement
Dutch DPA Fines Uber EUR 824,990,000 Over Automated Driver Deactivations
The Dutch data protection authority fined Uber for unlawful solely automated decision-making and weak transparency under GDPR Articles 22 and 13. Uber has appealed.
What happened?
The Dutch data protection authority, the Autoriteit Persoonsgegevens, fined Uber EUR 824,990,000. The European Data Protection Board published a summary on 8 October 2026.
The authority found two infringements of the GDPR:
- Article 22. Uber made decisions about drivers by solely automated means. When fraud was suspected, or customer ratings were too low, driver accounts were deactivated automatically. Deactivation was temporary in some cases and permanent for persistently low ratings. Drivers lost income as a result.
- Article 13. Uber did not give drivers enough information about its automated decision-making.
How did it reach the Dutch authority?
The case began with complaints from 171 French drivers, made through the Ligue des droits de l’Homme to the French authority, the CNIL. Uber’s European headquarters are in the Netherlands, so the Dutch authority led the case under the GDPR one-stop-shop procedure. The incidents covered ran from 2018 to 2022.
Is the decision final?
No. Uber has stopped the violations and has appealed the fine. No final court decision has been made.
Why does it matter?
Article 22 limits decisions based solely on automated processing that have legal or similarly significant effects on a person. This decision shows an authority applying it to work platforms, where an automated flag can end someone’s income. It also ties the transparency duty in Article 13 to automated decisions.
What should you do?
Treat this as a prompt to review, not as settled law until the appeal ends. List the decisions your systems make about people without a human in the loop. For each, check whether a person genuinely reviews the outcome, and whether notices explain the logic and likely effects. See our GDPR guide.
What to watch
- The outcome of Uber's appeal, and whether courts accept the authority's reading of Article 22 for platform account deactivations.
- Whether other authorities act on similar complaints about automated deactivation, scoring or ranking of gig workers.
- Your own automated decisions that cut off access, pay or accounts. Check whether a person genuinely reviews them, and whether the privacy notice explains the logic.
Sources and official references
- Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-making and insufficient information on profiling — European Data Protection Board (official source)
- Uber fined nearly 825 million euros for automated driver blocking — Autoriteit Persoonsgegevens (Dutch DPA) (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
General educational information, not legal or professional advice. Check the official sources and take qualified advice before acting.
