The Dutch Data Protection Authority is fining Uber €825 million (about $966 million), the second-largest penalty ever handed down under the EU's General Data Protection Regulation, ruling that the ride-hailing giant used automated systems to suspend drivers without meaningful human oversight.
“A Computer Should Not Make Decisions On Its Own”
The regulator, which handles Uber cases because the company's European headquarters sit in Amsterdam, was investigating complaints that Uber deactivated driver accounts between 2018 and 2022 through automated processes without adequate warning or a real appeals path. Deputy chair Monique Verdier said Uber had “committed serious infringements” and added: “A computer should not make decisions on its own that have [such] major consequences.” Under GDPR, algorithmic decisions that materially affect individuals require genuine human involvement and a way to contest the outcome.
From One French Driver To A €825M Fine
The case has an unusually personal origin story. Former Paris Uber driver Brahim Ben Ali told Dutch newspaper de Volkskrant that after his account was deactivated in 2019, he collected testimonies from 171 other drivers and brought his complaint to the Netherlands. He was helped by Swiss digital-rights non-profit PersonalData.io, whose founder Paul-Olivier Dehaye said a driver “can complete a thousand journeys with satisfied passengers, but if just one person reports a very serious problem, the consequences can be enormous.” Dehaye said this is the third Dutch fine tied to that same group's complaints, following a €290 million penalty in 2024 over driver data transfers and a smaller €10 million fine on related issues.
Uber Will Appeal, Class Actions To Follow
“We strongly disagree with this decision and disproportionate fine,” an Uber spokesperson told Reuters, arguing that most suspensions are brief, that permanent deactivations require human review, and that drivers have appeal rights. The regulator disputes that account. Dehaye said he is launching a new company, StartClaims, to run a class-action seeking compensation for affected drivers and to extend the model to other gig-economy and adtech cases. The penalty trails only the €1.2 billion Ireland levied on Meta in 2023 over transatlantic data transfers as the largest GDPR fine on record.
Regulatory Pressure Piles Up On AI-Driven Platforms
The ruling arrives as European regulators sharpen their focus on automated decision-making in mobility and platform work, and as U.S. courts and agencies weigh similar questions. It also comes alongside other Uber flashpoints this year, from Uber's 2,000-vehicle robotaxi order with Pony.ai for Europe and the Middle East to its Zipline drone-delivery expansion for Uber Eats.
Reporting based on coverage from TechCrunch, Reuters, Bloomberg, Quartz and de Volkskrant.