Uber is facing an €825 million fine from a Dutch watchdog for breaching Europe’s general data protection regulation (GDPR) by deactivating driver accounts through automated systems without adequately informing them.

The Dutch Data Protection Authority penalty would be the second largest issued under GDPR, behind the €1.2 billion fine imposed on Meta Platforms by Ireland in 2023 for unlawfully transferring European Facebook users’ data to the United States. Meta is appealing that ruling. Uber said it would also appeal.

Detours, fraud checks and suspended accounts

Uber temporarily suspended the accounts of some drivers who were suspected of fraud, including when its systems concluded that drivers had taken unnecessary detours to inflate fares, or had accepted trips without intending to complete them.

Uber said such suspensions were usually brief, and that it did not permanently deactivate those accounts without a human review.

Drivers with low customer ratings were sometimes permanently deactivated by computer, the regulator said. Uber disputed that, saying it had never automated permanent deactivation decisions.

The San Francisco headquartered company said one reason it considers the fine disproportionate is that only a small number of drivers were affected, with 126 having been deactivated in Europe as a result of low customer ratings in 2021.

The rule Uber is accused of breaking

The data protection rules ban decisions made solely by computer algorithms when they have a significant impact on people’s lives, saying such decisions require meaningful human review and a way to challenge a decision.

“The AP (the Dutch Data Protection Authority) has determined that Uber violated drivers’ rights, specifically the right not to be subject to automated decision-making that has … significant consequences,” the regulator said. “Uber has also violated the right to be informed,” it added, saying the agency considered it a serious matter worthy of the large fine.

Why UK employers should read the small print

Britain is outside the EU regime, but the substance of the rule survives in UK GDPR. The Information Commissioner’s Office sets out the same right not to be subject to a decision based solely on automated processing where that decision produces legal effects or similarly significant ones. Where firms do make such decisions, the regulator expects them to provide meaningful information about the logic involved, to let people request human intervention, express their point of view and contest the outcome, and to complete a data protection impact assessment before the processing starts.

That is not a problem confined to companies the size of Uber. Any business running automated checks that can cut off a worker, a contractor, a seller or a customer, from fraud scoring and identity verification to ratings thresholds and screening software, is making the kind of decision the rules cover. The compliance question is rarely whether a human exists somewhere in the process, but whether that human genuinely reviews the case and whether the person on the receiving end was told the system was there at all.

British regulators have shown they will use their powers. The ICO fined Reddit £14.47 million over children’s data protection failures this year, one of a run of penalties aimed at how platforms handle personal information.

Uber has already been tested on the point in the UK. Drivers have brought tribunal claims alleging that automated facial verification software wrongly terminated their accounts, and the company set aside hundreds of millions of dollars to settle UK driver employment claims after the Supreme Court ruled that its drivers were entitled to worker status.

The penalty also lands in the middle of a transatlantic row over how Europe polices American technology companies. Hefty EU regulatory fines on US tech firms have been criticised by President Trump. In April a top US state department official said they were the “biggest single source of friction” in US and EU economic relations.”

Uber, for its part, is unmoved. “We strongly disagree with this decision and disproportionate fine,” an Uber spokesperson said, adding that the company takes drivers’ rights seriously and that its policies include both human reviews and opportunities for drivers to dispute platform suspensions.