What happened
On 10 September 2026 the Dutch data protection authority fined Uber €824,990,000. Between 2018 and 2022 software tracked drivers' driving behaviour and customer ratings: if it detected suspected fraud or ratings that were too low, it deactivated the account automatically, sometimes temporarily, and permanently where low ratings persisted. While deactivated, drivers lost their Uber income. There was no human review, and drivers were not sufficiently informed. The case began with complaints from 171 French drivers filed through the Ligue des droits de l'Homme with the CNIL; the Dutch authority handled it because Uber's European headquarters are in the Netherlands. The EDPB relayed the decision on 8 October.
Uber has stopped the infringements and announced an objection. It argues that people were involved in permanent deactivations. This is the fourth Dutch fine on Uber, after €600,000 in 2018, €10 million in 2023 and €290 million in 2024, and the second-highest GDPR fine ever after Meta's in 2023. The cap is 4% of worldwide turnover: in 2025 Uber's turnover was about €44.5 billion.
Why the problem is not the algorithm, but the missing person
Article 22 does not prohibit using a score. It prohibits letting the score decide alone when the decision produces legal effects or similarly significantly affects the person. Losing your income overnight is exactly that kind of effect. The exceptions in paragraph 2 (contract, law, consent) are not enough on their own: paragraph 3 still requires the right to obtain human intervention, to express one's point of view and to contest the decision.
- Human intervention must be real: a person with the authority and competence to change the outcome, not someone who rubber-stamps in bulk.
- It must be available before the decision takes effect, not only as an after-the-fact complaint.
- Customer ratings and fraud signals are the driver's personal data, and combining them is profiling.
- The privacy notice must explain that automated decision-making exists, the logic involved and the envisaged consequences (Article 13(2)(f)).
- A system that suspends people automatically is high-risk processing: an impact assessment is needed before it goes live.
The question to ask your clients this week
Is there a system that blocks, excludes or downgrades a person without anyone looking first? The answers come from unexpected places: the CRM that suspends a customer in arrears, the platform that drops a supplier below a threshold, the HR system that blocks a badge after a number of anomalies, the filter that discards CVs. For each one, three things must be written down: who reviews the decision, by when, and how the person is informed and can contest it.
The case matters beyond the Netherlands. It was coordinated with the other European authorities, the CNIL worked with the Dutch authority, and from 2 December 2026 the Platform Work Directive brings even stricter rules on human oversight of algorithmic decisions. But it remains a decision under appeal: read it as a strong signal of how authorities interpret Article 22, not yet as settled law.
In practice: in the record of processing, for every processing that uses scores or automatic rules, one line stating whether there is an automated decision under Article 22, which exception justifies it and who reviews it. If that line is missing, it is the first one to write: it is the one an authority would ask for first.
Official source:Autoriteit Persoonsgegevens — Uber krijgt boete van bijna 825 miljoen euroOfficial source:EDPB — Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-makingLooking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
