Uber fined €825 million over automated driver suspensions

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed an €825 million fine on Uber for violating the General Data Protection Regulation (GDPR). The penalty, which is the second largest under GDPR to date, concerns the company’s use of fully automated software to suspend or permanently deactivate driver accounts between 2018 and 2022.

The regulator found that Uber’s algorithms made significant decisions regarding drivers’ livelihoods—such as deactivating accounts due to suspected fraud or low customer ratings—without sufficient human review or adequate notification to the affected individuals. Under EU law, automated decisions that significantly impact a person's life are restricted unless they include a mechanism for human intervention and a clear path for appeal.

Uber has contested the ruling, describing the sanction as “disproportionate” and arguing that the regulator examined discontinued policies. The company maintains that most suspensions are temporary and that permanent exclusions are subject to human control. Uber intends to appeal the decision. Meanwhile, the NGO PersonalData.io is preparing a class-action lawsuit to seek financial reparations for drivers who were wrongly sanctioned.