The Dutch Data Protection Authority (AP) has fined Uber €825 million ($966 million) under GDPR rules for automatically suspending driver accounts without adequate notification. Uber plans to appeal the decision, calling the fine disproportionate.
This significant fine underscores the strict enforcement of GDPR, particularly concerning automated decision-making that impacts individuals' livelihoods, and highlights the potential financial and legal risks for companies relying heavily on algorithms for critical functions.
The Dutch Data Protection Authority (AP) has decided to fine Uber €825 million ($966 million) under European data protection rules for deactivating driver accounts through automated systems without adequately informing them. This penalty would be the second-largest ever issued under Europe's General Data Protection Regulation (GDPR), following a €1.2 billion fine imposed on Meta in 2023. Uber has stated it will appeal the decision, calling the fine disproportionate and asserting that its current policies include human reviews for suspensions. The AP confirmed the decision, noting that Uber violated drivers' rights not to be subject to automated decision-making with significant consequences and the right to be informed. The case, which concerns European incidents from 2020 to 2022, was handled by the Dutch regulator due to Uber's European headquarters being located in the Netherlands. The incidents involved temporary suspensions for suspected fraud, such as unnecessary detours or uncompleted trips, and permanent suspensions for low customer ratings, though Uber claims permanent deactivations no longer rely solely on automated systems.