Dutch regulator fines Uber €825 million over automated driver deactivations

Penalty for automated deactivations

The Dutch Data Protection Authority (AP) has imposed an €825 million ($966 million) fine on Uber Technologies for deactivating driver accounts through automated software systems without adequate human oversight. The penalty, formalized in an August 17 decision, was issued under the European Union's General Data Protection Regulation (GDPR) and covers platform practices between 2020 and 2022. The ruling represents the second-largest penalty ever issued under EU privacy legislation, surpassed only by the €1.2 billion fine imposed on Meta by Irish regulators in 2023 over transatlantic user data transfers. Because Uber maintains its European headquarters in Amsterdam, the Dutch privacy watchdog handled the investigation on behalf of European authorities.

French complaint and algorithmic monitoring

The regulatory investigation originated from a formal complaint submitted by 171 French drivers through the Human Rights League (Ligue des droits de l'Homme). Investigators determined that between 2018 and 2022, Uber utilized algorithmic software to monitor driver behavior, route selections, and customer feedback, enforcing account suspensions without human intervention. The automated systems flagged suspected fraud, including instances where algorithms concluded drivers had taken unnecessary detours to artificially increase fares or had accepted ride requests without intending to complete them. Drivers who accumulated low passenger ratings also faced permanent account deactivation directly through the automated software. When accounts were blocked, drivers instantly lost the ability to accept rides and earn an income.

Regulatory standards and Uber's response

European data protection rules prohibit organizations from subjecting individuals to decisions based solely on automated computer processing whenever those determinations produce significant effects on their livelihoods. The Dutch regulator determined that Uber breached both this prohibition and the legal requirement to provide individuals with transparent information regarding algorithmic systems.

Uber has committed serious violations. Drivers were deactivated without justification. From one moment to the next, they were left without income through Uber. That is prohibited. A computer should not make decisions on its own that have significant consequences for users. These decisions should have been reviewed beforehand by a human being.

Uber announced that it will appeal the decision before Dutch courts, arguing that the financial penalty is unjustified and disproportionate. The company stated that its current operational policies guarantee manual human reviews for suspensions and provide structured channels for drivers to dispute disciplinary measures. Uber also maintained that it never enforced permanent account terminations solely through algorithms and noted that the disputed procedures investigated by the authority have not been active for several years.

We strongly disagree with this decision and disproportionate fine.

History of regulatory fines in the Netherlands

The €825 million sanction is the fourth financial penalty imposed on Uber by the Dutch Data Protection Authority since 2018. The regulator previously fined the transport platform €600,000 in 2018, followed by a €10 million fine in 2023, and a €290 million fine in 2024 for transferring European drivers' personal data to servers in the United States without adequate safeguards. Uber is also appealing the 2024 transatlantic data transfer fine.