Uber Faces €825M Dutch GDPR Fine Over Automated Driver Suspensions

Uber has been fined €825 million, about $966 million, by the Dutch Data Protection Authority over allegations that automated systems suspended or deactivated European drivers without adequate information or meaningful human oversight.

The penalty is the second-largest issued under the European Union’s General Data Protection Regulation, according to Reuters. Uber disputes the regulator’s findings and the size of the fine and plans to appeal.

Regulator challenges automated driver decisions

The case covers incidents from 2018 through 2022 and originated with complaints from drivers in France. Dutch authorities handled the investigation because Uber’s European headquarters are in the Netherlands.

The regulator found that Uber used automated systems to make decisions affecting drivers suspected of fraud and those with low customer ratings. It said some drivers suffered major consequences without sufficient warning or human involvement, raising concerns under GDPR rules governing decisions made solely through automated processing.

Uber said most temporary suspensions were brief and maintained that permanent deactivations do not occur without human review. The company also said drivers can challenge suspension decisions. Uber specifically disputes the regulator’s conclusion that some drivers were permanently removed solely through automated processes.

Drivers helped bring the case forward.

Former French Uber driver Brahim Ben Ali played a central role in organising complaints after his account was deactivated in 2019. He eventually gathered testimony from roughly 170 other drivers, according to de Volkskrant.

The drivers received assistance from Swiss digital-rights nonprofit PersonalData.io, which helps platform workers obtain and understand personal information used by algorithmic systems. The group’s founder, Paul-Olivier Dehaye, told Reuters that it is now preparing a class action seeking compensation for affected drivers.

The decision adds to Uber’s previous disputes with the Dutch privacy regulator. The authority previously imposed a €10 million fine after finding that Uber failed to provide sufficient transparency about how European drivers’ personal data was stored, transferred and made available to them.

Case raises broader questions about algorithmic management

The decision also highlights disagreement over how companies should use automated systems to manage large workforces. Daring Fireball’s John Gruber questioned whether the ruling could make it harder for Uber to automatically identify misconduct, arguing that companies establish the policies while software measures compliance.

Dehaye countered that the central issue is not whether Uber can penalise drivers who violate its rules, but whether decisions with major consequences for a person’s livelihood receive appropriate accountability and human oversight.

The appeal will determine whether the €825 million penalty survives judicial review. For gig-economy platforms more broadly, the case could further clarify how European privacy rules apply when algorithms influence whether workers can continue earning through a platform.