Dutch Regulator Fines Uber €825 Million for Firing Drivers by Algorithm
Europe's largest-ever GDPR fine landed on Uber after the Dutch data protection watchdog found that automated software suspended driver accounts, sometimes permanently, with no human ever checking whether the decision was right.
Key points
- The Dutch Data Protection Authority (AP) fined Uber €825 million (roughly $964 million) for breaching GDPR, the EU's main privacy law.
- Uber's automated software suspended driver accounts, including permanent bans, without any human reviewing the decisions for errors.
- The fine is widely considered the largest single GDPR penalty ever issued against one company.
- The AP holds jurisdiction because Uber's European headquarters is registered in the Netherlands.
Uber drivers in Europe lost their livelihoods to a machine. No manager reviewed the call, and no appeal landed in a human inbox. According to the Dutch Data Protection Authority (AP), that process broke EU law, and the company now faces an €825 million bill as a result.
The AP announced the fine on Friday. GDPR, the General Data Protection Regulation, is the EU's main privacy law. It sets strict rules on how companies can use personal data to make decisions that seriously affect people, including employment. One of those rules says people have the right to a meaningful human review before an automated system ends their livelihood.
What did Uber actually do wrong?
Uber used automated software to flag and suspend driver accounts, sometimes permanently. The AP found that no human checked those decisions for errors.
For a driver, a suspended account means no income. An algorithm deciding that, with no human backstop, is exactly what GDPR's rules on automated decision-making are designed to prevent. The question of how governments should constrain such tools is live beyond Europe too: we covered Australia's push for binding rules on automated government decisions in our 22 July story.
Uber's European headquarters sits in the Netherlands, making the AP the lead supervisory authority for GDPR purposes across the EU.
How big is this fine?
| Detail | Figure |
|---|---|
| Fine amount (euros) | €825 million |
| Fine amount (US dollars, approx.) | $964 million |
| Regulator | Dutch Data Protection Authority (AP) |
| Legal basis | EU GDPR |
| Uber's European HQ | Netherlands |
At roughly $964 million, this is widely considered the largest single GDPR fine on record. Meta was fined €1.2 billion by Irish regulators in 2023 for a different GDPR violation involving cross-border data transfers. Uber hasn't said publicly whether it will appeal.
Should you worry if an algorithm flags your account?
If you're an Uber driver whose account has been restricted or suspended, GDPR gives you the right to request that a human review the automated decision. You can also ask Uber for the personal data it used to reach that decision, a process called a subject access request.
More broadly, if any company tells you an automated system made a decision affecting your job or finances, EU law gives you the right to contest it and demand human intervention. That right exists whether or not the company volunteers the information.
This story was first reported by SecurityWeek. The AP is expected to publish its full decision in the coming weeks.
