Part of the AI Regulation News hub. See Europe AI Regulation.
The Dutch data protection authority fined Uber 824,990,000 euro for deactivating driver accounts by fully automated decision, with no human review in the loop
Correction, October 1, 2026. This article removes an unsupported finding about an appeals channel, qualifies statements about the proceedings, restores accents in quotations and aligns the displayed publication date with the original August 24 record. The original publication timestamp is unchanged.
The Dutch AP announced a fine of 824,990,000 euro over automated driver-account deactivation and inadequate information to drivers. Its August 21 announcement describes conduct between 2018 and 2022 and says the violations had ended.
Bottom line: The AP announced a fine against Uber. Its August 21 Dutch announcement says Uber intended to lodge an objection (bezwaar). We have not reviewed the underlying decision, any later objection outcome or the procedural effect of that objection.
Who this affects: HR and people-operations leaders running automated suspension or offboarding, employment attorneys and in-house counsel at platform and gig companies, DPOs and compliance officers who own algorithmic-management systems, and deal professionals diligencing platform workforce exposure.
Issue date: 21 August 2026, the date the AP published its decision announcement. The page carries no case number and no deadline for anyone other than Uber.
What changed: A European supervisor put a nine-figure number on automated account deactivation. Per the AP, fraud suspicion or low customer ratings triggered automatic temporary deactivation, and persistent low ratings triggered permanent deactivation. Its words: "Hier kwam geen menselijke beoordeling aan te pas" (no human assessment was involved).
Analysis: The AP describes fully automated deactivation without human assessment. That finding gives operators a reason to examine how consequential decisions are made and explained; the announcement does not determine the legal position of every other system or the effect of a particular review procedure.
Primary sources: AP announcement (Dutch) · CNIL communique on the same fine, 24 August 2026 (French; an actualite, not a CNIL decision)
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
- Instrument (EN)
- Fine decision announcement: Uber fined nearly 825 million euro for automated blocking of drivers
- Authority
- Autoriteit Persoonsgegevens (AP), the Dutch data protection authority. Vice-chair Monique Verdier is the named speaker.
- Jurisdiction
- Netherlands, acting as lead supervisory authority because Uber's European head office sits there. Handled through the GDPR one-stop-shop (eenloketmechanisme) after a French complaint.
- Status
- Fine announced against Uber. The August 21 Dutch announcement reports an intended objection; its later outcome and procedural effect are unverified here.
- Bindingness
- An enforcement action against Uber, as described in the regulator's announcement. This article does not establish the position of other controllers or examine the operative decision.
- Issue date / next deadline
- Announced 21 August 2026; page last updated 21 August 2026. No public deadline for third parties.
- Amount
- 824,990,000 euro. The AP notes GDPR fines are capped at 4% of worldwide annual turnover and that Uber's 2025 worldwide revenue was about 44.5 billion euro.
- Conduct period
- 2018 to 2022. The AP states the violations have since been ended.
- Primary source
- https://www.autoriteitpersoonsgegevens.nl/actueel/uber-krijgt-boete-van-bijna-825-miljoen-euro-voor-geautomatiseerd-blokkeren-van-chauffeurs
How the case started, and what CNIL says its role was
The case did not begin in the Netherlands. CNIL's communique of 24 August 2026 records that in 2020 it received a collective complaint from the association La Ligue des droits de l'Homme, representing more than 170 Uber drivers, and that the complaint was supplemented in 2021. CNIL says the Dutch authority was competent to investigate because Uber's main establishment is in the Netherlands.
CNIL describes cooperating closely with its Dutch counterpart throughout the procedure: during the checks, during the analysis of the evidence obtained, and when the draft decision was examined under the one-stop-shop procedure. It says it informed the complainants as the GDPR provides.
CNIL published a communique giving its account of the Dutch decision. It is not a French enforcement decision. It does not reproduce or name the binding Dutch instrument, and it carries no decision number, so anyone citing the operative act needs the AP's own decision rather than this page.
On the substance, CNIL reports that the Dutch authority considered, among other things, that deactivations on suspicion of fraud (temporary) and on low customer ratings (temporary and permanent) constitute automated individual decisions. The reason CNIL gives, in the original French and with the source's typographic apostrophes normalised to TLY house style, is en raison de l'absence totale d'intervention humaine dans le processus de décision: because of the total absence of human intervention in the decision process.
What the AP actually found
The AP describes software that tracked driving behaviour and customer ratings. When it flagged a suspicion of fraud, or when ratings were too low, the driver's account was deactivated automatically. Persistent low ratings led to permanent deactivation. In the AP's sentence: "Hierdoor viel tijdens de deactivatie hun inkomen via Uber weg" - as a result, their income through Uber fell away during the deactivation.
The AP says Uber breached "het verbod op volledig geautomatiseerde besluitvorming uit de Algemene verordening gegevensbescherming (AVG)", the GDPR's prohibition on fully automated decision-making, and gave drivers insufficient information about that processing. Its announcement cites no article numbers. CNIL's communique identifies Article 22 for the automated-decision finding; this review does not assign a specific article to the information finding.
The trigger was not a Dutch complaint. Per the AP, 171 French drivers went to the Ligue des droits de l'Homme, which filed a complaint with the French privacy regulator on their behalf. The AP took the investigation because Uber's European head office is in the Netherlands, ran it in close cooperation with the French supervisor, and coordinated the fine decision with other European supervisors.
The conduct described in the announcement
This is historical. "Dit speelde tussen 2018 en 2022," says the AP, and "Uber heeft de overtredingen inmiddels beëindigd" - Uber has since ended the violations. Anyone reading this as a description of how Uber deactivates drivers today is reading it wrong.
The announcement reports historical conduct and an intended objection. It does not establish that the proceedings are closed or fix the likely sanction for another operator.
Where the money came from
The AP explains that all European privacy supervisors calculate fines the same way and that the ceiling is 4% of worldwide annual turnover, with Uber's 2025 worldwide revenue at about 44.5 billion euro. The announced amount is below that stated ceiling. The AP does not publish its own step-by-step calculation on this page, and we are not going to reconstruct one for it.
The August announcement says this is the AP's fourth fine against Uber. It lists 600,000 euro in 2018, 10 million euro in 2023, and 290 million euro in 2024, and says Uber is contesting the last two with those procedures still running.
The operating test this hands you
Strip out the ride-hailing specifics and the question a compliance officer has to answer is narrow. Can any system you own suspend, restrict, or cut off a person's earnings without a documented human assessment before the effect lands?
The AP announcement does not describe a particular appeals channel or determine whether such a channel was adequate. It says the deactivation decisions involved no human assessment. Assessing a review mechanism requires the underlying decision and the applicable legal requirements.
Practical diligence questions. Which automated actions in your stack have a financial effect on an individual? For each one, is there a named human who reviews before it takes effect, and can you produce evidence of that review? What were people told, in advance, about the logic that can trigger it? These questions identify evidence to collect; they do not substitute for analysis of the applicable obligations.
What we did not verify
This update checked the AP's Dutch announcement in full and the CNIL's August 24 communique. The AP announcement is dated August 21, 2026 and carries the same date for its last update.
We did not open a decision document. The AP page publishes no case number, no kenmerk and no zaaknummer, and does not link a full decision. We did not read the underlying boetebesluit, and we did not read the Reuters-reported document said to carry a 17 August date. We have no view on that date because we have not seen the document.
We refuse to claim: an internal decision date; a decision number; that this is the largest GDPR fine ever for automated decision-making, which the AP page does not say; that this binds controllers outside the Netherlands, because it is a national decision taken through the one-stop-shop and not an EDPB decision. The AP page says Uber announced a bezwaar, which is an objection under Dutch administrative procedure; we did not verify the procedural route or timetable that follows it, so we do not describe it as an appeal or predict what happens next. The Article 22 reference comes from CNIL's communique, not the AP announcement. We have not verified the operative decision's provisions for the information finding.
Review automated actions that affect a person's earnings, the human role in those decisions and the information provided to the person. The AP announcement reports no human assessment in the deactivation decisions. It does not establish the adequacy of a particular appeals process or the likely outcome for another controller.
Source File
Open the AP announcement and confirm four things: the figure 824.990.000 euro; the sentence "Hier kwam geen menselijke beoordeling aan te pas"; the period statement "Dit speelde tussen 2018 en 2022" together with "Uber heeft de overtredingen inmiddels beëindigd"; and that the string artikel 22 does not appear anywhere on the page.
Een computer mag niet zelfstandig besluiten nemen die grote gevolgen voor jou hebben. Hier had eerst een mens naar moeten kijken. [A computer may not independently take decisions that have major consequences for you. A human should have looked at this first.] · Monique Verdier, vicevoorzitter AP, 21 August 2026
FAQ
Does Uber still deactivate drivers automatically?
The August 21 announcement describes conduct between 2018 and 2022 and says the violations had ended. It does not establish how Uber's current deactivation system works.
Is this an EU-wide ruling that binds my company?
The announcement concerns a fine against Uber. The AP acted as lead supervisor and says it coordinated the decision with other European supervisors. We have not reviewed the operative decision; the announcement alone does not establish the legal position of another company.
Which GDPR provision is at issue?
The AP announcement describes the prohibition on fully automated decision-making and inadequate information to drivers without citing article numbers. CNIL's communique identifies Article 22 for the automated-decision finding. The specific provision for the information finding has not been verified against the operative decision.
Is an appeals process enough if the decision itself is automated?
The announcement does not answer that question for a particular appeals process. It reports fully automated deactivation without human assessment but does not describe the details of an appeals channel. Assess the actual decision and review mechanism against applicable legal requirements.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.