The Dutch Data Protection Authority (AP) has fined Uber €825 million (approximately $966 million) for violating the European Union’s General Data Protection Regulation (GDPR) through its automated handling of driver account deactivations. The penalty, reported by Reuters, is the second-largest GDPR fine issued in Europe to date, and it stems from complaints that Uber deactivated driver accounts without sufficient warning or human oversight.
Monique Verdier, deputy chair of the Dutch regulator, said in a statement that Uber had committed “serious infringements,” emphasizing that “a computer should not make decisions on its own that have major consequences.” The AP’s investigation focused on how Uber used automated processes to suspend or deactivate drivers, particularly in cases where the decision was made solely by algorithms.
Also read: Crude Oil Extends Rally to 3-Week High as Strait of Hormuz Tensions Persist
Uber has pushed back against the regulator’s findings, arguing that most driver suspensions are brief, that no permanent deactivations occur without human review, and that drivers have the right to appeal. However, the Dutch regulator maintains that some drivers were permanently deactivated without any human intervention — a claim Uber disputes. The company has announced it will appeal the decision, with a spokesperson telling Reuters, “We strongly disagree with this decision and disproportionate fine.”
How the complaint reached the Dutch regulator
The case traces back to Brahim Ben Ali, a former Uber driver in France whose account was deactivated in 2019. Ben Ali collected testimonies from 171 other drivers who reported similar experiences, and with the help of the Swiss digital rights nonprofit PersonalData.io, he filed a complaint in the Netherlands, where Uber’s European headquarters are located.
Also read: TikTok and ByteDance to Pay $400 Million to Settle Children's Privacy Lawsuit
Paul-Olivier Dehaye, founder of PersonalData.io, told TechCrunch that drivers can complete thousands of successful trips, but “if just one person reports a very serious problem, the consequences can be enormous.” Dehaye, who assisted the drivers in gathering data about how deactivation decisions were made, noted that this is the third fine the Dutch regulator has levied on Uber — following a €290 million penalty over handling of drivers’ personal data and a €10 million fine for related issues.
Dehaye also revealed plans to launch a class action suit to seek compensation for affected drivers, and he is starting a new company called StartClaims to support litigation and regulatory action — initially against Uber, with plans to expand to other gig economy platforms and areas like adtech.
The debate over automated decision-making
The case has sparked a broader debate about the role of automation in employment decisions. John Gruber of Daring Fireball argued that the fine could make it “unlawful in the EU for Uber to monitor its drivers for pulling scams against customers, or just never picking riders up, leaving them stranded.” Gruber also criticized the regulator’s framing, comparing it to blaming a time clock for firing a habitually late employee.
Dehaye countered that Gruber “misses the point,” arguing that Uber is free to use humans to punish drivers who scam, but then it must take responsibility for that decision-making — “like ‘being an employer’, not ‘being a marketplace’.” This distinction lies at the heart of the GDPR’s provisions on automated decision-making, which give individuals the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
What this means for gig economy platforms
This fine signals that European regulators are increasingly scrutinizing how gig economy companies use algorithms to manage workers. For Uber and similar platforms, the ruling underscores the need for transparent, human-reviewed processes when making decisions that affect workers’ livelihoods. The outcome of Uber’s appeal will be closely watched, as it could set a precedent for how GDPR applies to algorithmic management across the industry.
For drivers, the case highlights the importance of data protection rights and the potential for collective action. As Dehaye’s StartClaims initiative suggests, this may be just the beginning of a wave of litigation aimed at holding gig economy platforms accountable for their use of automated systems.
This article is for informational purposes only and does not constitute financial or legal advice. The regulatory and legal sector is evolving, and outcomes may vary.
