Part of the AI Regulation News hub.
The Dutch data protection authority fined Uber 824,990,000 euro for deactivating driver accounts by fully automated decision, with no human review in the loop
The AP priced a fully automated cutoff of income at 824,990,000 euro. Uber stopped the practice years ago, so the value here is not descriptive. It is a price tag for every other operator whose software can still suspend a person without a human looking first.
Bottom line: Binding on Uber. This is a national fine imposed by the Dutch supervisory authority, not an EU-wide rule and not an EDPB decision. The AP says Uber has announced it will lodge an objection (bezwaar) against the fine, so the amount is not settled.
Who this affects: HR and people-operations leaders running automated suspension or offboarding, employment attorneys and in-house counsel at platform and gig companies, DPOs and compliance officers who own algorithmic-management systems, and deal professionals diligencing platform workforce exposure.
Issue date: 21 August 2026, the date the AP published its decision announcement. The page carries no case number and no deadline for anyone other than Uber.
What changed: A European supervisor put a nine-figure number on automated account deactivation. Per the AP, fraud suspicion or low customer ratings triggered automatic temporary deactivation, and persistent low ratings triggered permanent deactivation. Its words: "Hier kwam geen menselijke beoordeling aan te pas" (no human assessment was involved).
Analysis: Read the mechanism, not the headline number. What the AP describes is software making the adverse call and the income stopping at that moment. Nothing in the AP account turns on the accuracy of the fraud detection. If your system can cut a person off before a human has looked, the exposure is structural and it does not wait for you to be wrong.
Primary sources: AP announcement (Dutch)
- Instrument (EN)
- Fine decision announcement: Uber fined nearly 825 million euro for automated blocking of drivers
- Authority
- Autoriteit Persoonsgegevens (AP), the Dutch data protection authority. Vice-chair Monique Verdier is the named speaker.
- Jurisdiction
- Netherlands, acting as lead supervisory authority because Uber's European head office sits there. Handled through the GDPR one-stop-shop (eenloketmechanisme) after a French complaint.
- Status
- Announced and binding on the addressee. The AP page states Uber has announced an objection (bezwaar).
- Bindingness
- Binding on Uber. Not binding on anyone else. It is persuasive evidence of how at least one European supervisor prices this pattern, nothing more.
- Issue date / next deadline
- Announced 21 August 2026; page last updated 21 August 2026. No public deadline for third parties.
- Amount
- 824,990,000 euro. The AP notes GDPR fines are capped at 4% of worldwide annual turnover and that Uber's 2025 worldwide revenue was about 44.5 billion euro.
- Conduct period
- 2018 to 2022. The AP states the violations have since been ended.
- Primary source
- https://www.autoriteitpersoonsgegevens.nl/actueel/uber-krijgt-boete-van-bijna-825-miljoen-euro-voor-geautomatiseerd-blokkeren-van-chauffeurs
What the AP actually found
The AP describes software that tracked driving behaviour and customer ratings. When it flagged a suspicion of fraud, or when ratings were too low, the driver's account was deactivated automatically. Persistent low ratings led to permanent deactivation. In the AP's sentence: "Hierdoor viel tijdens de deactivatie hun inkomen via Uber weg" - as a result, their income through Uber fell away during the deactivation.
Two findings, not one. First, that Uber breached what the AP calls "het verbod op volledig geautomatiseerde besluitvorming uit de Algemene verordening gegevensbescherming (AVG)", the GDPR's prohibition on fully automated decision-making. Our mapping, not the AP's citation: that prohibition lives in Article 22. The AP page does not use the article number. Second, that Uber gave drivers insufficient information about the automated decision-making. We would map that to the Articles 13 and 14 transparency duties; again, that mapping is ours.
The trigger was not a Dutch complaint. Per the AP, 171 French drivers went to the Ligue des droits de l'Homme, which filed a complaint with the French privacy regulator on their behalf. The AP took the investigation because Uber's European head office is in the Netherlands, ran it in close cooperation with the French supervisor, and coordinated the fine decision with other European supervisors.
The conduct is over, and that is the point
This is historical. "Dit speelde tussen 2018 en 2022," says the AP, and "Uber heeft de overtredingen inmiddels beeindigd" - Uber has since ended the violations. Anyone reading this as a description of how Uber deactivates drivers today is reading it wrong.
Which is exactly why it is worth your time. A closed enforcement file is a published price. The AP has now shown what it thinks a four-year run of automated income cutoffs is worth, and it did so with the fine decision coordinated across other European supervisors. If you are still running that pattern, the file that just closed against someone else is the one that gets cited against you.
Where the money came from
The AP explains that all European privacy supervisors calculate fines the same way and that the ceiling is 4% of worldwide annual turnover, with Uber's 2025 worldwide revenue at about 44.5 billion euro. Do the arithmetic and 824,990,000 euro sits well under that ceiling. The AP does not publish its own step-by-step calculation on this page, and we are not going to reconstruct one for it.
Worth noting for anyone building a risk model: the AP says this is its fourth fine against Uber. It lists 600,000 euro in 2018, 10 million euro in 2023, and 290 million euro in 2024, and says Uber is contesting the last two with those procedures still running. That is a supervisor with a file on this company going back years, not a first encounter.
The operating test this hands you
Strip out the ride-hailing specifics and the question a compliance officer has to answer is narrow. Can any system you own suspend, restrict, or cut off a person's earnings without a documented human assessment before the effect lands?
On these facts a review channel after the fact did not save the controller. That is a finding about this case, not a rule that post-hoc review is always insufficient. But it is the part that transfers, because most systems we see are built exactly that way: automate the cutoff for speed, staff the appeals queue for cleanup. The AP's account is that the income stopped first and the human, if any, came later.
Practical diligence questions. Which automated actions in your stack have a financial effect on an individual? For each one, is there a named human who reviews before it takes effect, and can you produce evidence of that review? What were people told, in advance, about the logic that can trigger it? Those three go straight into a data room, and in a platform or workforce-tech deal they are now a priced item rather than a checkbox.
What we did not verify
We opened and read the AP's own Dutch announcement in full, at the URL given above, and character-matched every Dutch quotation in this piece against that text. The page is dated 21 August 2026 and states it was last updated 21 August 2026.
We did not open a decision document. The AP page publishes no case number, no kenmerk and no zaaknummer, and does not link a full decision. We did not read the underlying boetebesluit, and we did not read the Reuters-reported document said to carry a 17 August date. We have no view on that date because we have not seen the document.
We refuse to claim: an internal decision date; a decision number; that this is the largest GDPR fine ever for automated decision-making, which the AP page does not say; that this binds controllers outside the Netherlands, because it is a national decision taken through the one-stop-shop and not an EDPB decision. The AP page says Uber announced a bezwaar, which is an objection under Dutch administrative procedure; we did not verify the procedural route or timetable that follows it, so we do not describe it as an appeal or predict what happens next. Article 22 and Articles 13 and 14 are our characterisation of what the AP describes in plain language, not citations the AP made.
The compliance point is the sequence, not the sector. Where software can end someone's income, the human assessment has to sit before the effect, and you have to be able to show it happened. On the AP's account of this case, a channel to complain afterwards did not cure a decision that was fully automated when it landed. Uber ended the practice years ago; the file is now a published price for anyone who has not.
Source File
Open the AP announcement and confirm four things: the figure 824.990.000 euro; the sentence "Hier kwam geen menselijke beoordeling aan te pas"; the period statement "Dit speelde tussen 2018 en 2022" together with "Uber heeft de overtredingen inmiddels beeindigd"; and that the string artikel 22 does not appear anywhere on the page.
Een computer mag niet zelfstandig besluiten nemen die grote gevolgen voor jou hebben. Hier had eerst een mens naar moeten kijken. [A computer may not independently take decisions that have major consequences for you. A human should have looked at this first.] ยท Monique Verdier, vicevoorzitter AP, 21 August 2026
FAQ
Does Uber still deactivate drivers automatically?
Not on the conduct the AP fined. The AP states the practice ran between 2018 and 2022 and that Uber has since ended the violations. This is an enforcement decision about historical conduct. Treat it as a precedent for other controllers, not as a description of Uber's current system.
Is this an EU-wide ruling that binds my company?
No. It is a Dutch national decision by the AP, which acted as lead supervisor because Uber's European head office is in the Netherlands. The AP used the GDPR one-stop-shop and says it coordinated the fine decision with other European supervisors, but this is not an EDPB decision and it binds only the addressee.
Which GDPR provision is at issue?
The AP's own words are the prohibition on fully automated decision-making in the GDPR, plus a failure to inform drivers adequately about that automated decision-making. It does not cite article numbers on this page. Our reading is that these correspond to Article 22 and to the Articles 13 and 14 information duties, and we flag that as our mapping rather than the regulator's.
Is an appeals process enough if the decision itself is automated?
It was not enough here. The AP's account is that accounts were deactivated automatically, income stopped during the deactivation, and no human assessment was involved in the decision. That is a finding on these facts. It does not establish that a post-hoc review channel is always insufficient, but it does mean a human review that only runs after the cutoff should not be assumed to cure the problem.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.