Dutch DPA fines Uber EUR 824.99 million for automated driver decisions

The Dutch data protection authority Autoriteit Persoonsgegevens (AP) has imposed a fine of EUR 824 990 000 on Uber B.V. The AP found that Uber made fully automated decisions about drivers, without human review.

In cases of suspected fraud or customer ratings that were too low, driver accounts were automatically deactivated temporarily or, where low ratings persisted, permanently. During deactivation, drivers lost the income they earned through Uber.

The case followed complaints from 171 French Uber drivers, submitted through the Ligue des droits de l’Homme to the French authority CNIL. Because Uber's European headquarters are in the Netherlands, the AP handled the case under the GDPR One-Stop-Shop mechanism. The incidents investigated took place between 2018 and 2022.

The AP found that Uber violated the GDPR prohibition on fully automated decision-making and did not sufficiently inform drivers about automated decision-making. According to the authority, Uber has now stopped these violations.

Uber has appealed the fine. There is not yet a final judicial decision.