Uber’s algorithm triggers €825 million fine

A driver opens the Uber app one morning and finds their account blocked. The platform's software flagged something: maybe an unusual route it read as fare inflation, maybe a run of low passenger ratings. No warning letter, no phone call, no human who looked at the case. Just a screen that says you can't work today.

That scenario sits at the center of an €825 million fine the Dutch Data Protection Authority (AP) imposed on Uber this week, the second-largest penalty ever issued under European privacy law, behind Meta's €1.2 billion sanction in 2023 (Reuters via Yahoo Finance, DutchNews). The regulator found that Uber used software to suspend or permanently cut off drivers across Europe without giving them adequate information or real human review (NOS, Euractiv).

The law that says a computer can't decide alone

The legal principle is Article 22 of the GDPR, Europe's data protection regulation. It gives people the right not to be subject to decisions made solely by software when those decisions significantly affect their lives (GDPR official text). A personalized ad recommendation doesn't qualify. Cutting off someone's income does.

Think of it as a bright line. Below it, software can still rank rides or flag patterns. Above it, where someone's income or legal standing is at stake, the GDPR requires three things: a human must actually review the case, the person must be told what data and logic drove the decision, and they must get a usable way to contest it (GDPR official text, EDPB-endorsed guidance). "Human review" doesn't mean a staff member clicking "confirm" on a dashboard. Regulatory guidance specifies that the reviewer must understand the software's output, see the underlying data, and have the authority to override it (EDPB-endorsed guidance).

The AP's deputy chair, Monique Verdier, put it plainly: drivers were made inactive without warning, and a computer should not independently make decisions with major consequences before a human looks at them (Xinhua).

French drivers, Dutch fine

The case began with complaints from French Uber drivers, reportedly involving 171 complainants, though no original complaint filing has surfaced publicly (Boursorama/AFP, Le Figaro/AFP). Under GDPR rules, the regulator in the country where a company has its EU headquarters usually leads cross-border cases. Because Uber is based in Amsterdam, the Dutch authority took charge, which is how a complaint by drivers in France produced a continent-wide enforcement decision (NRC).

The AP found that Uber's systems flagged drivers for suspected fraud or low ratings and suspended accounts without adequate explanation or an effective way to challenge the decision. Uber disputes key parts of this, saying permanent deactivations were not fully automated and that only 126 European drivers were deactivated in 2021 over low customer ratings (Reuters via Yahoo Finance, Quartz). The company calls the fine "disproportionate," says the practices under investigation were discontinued years ago, and confirms it will appeal (Bloomberg via Yahoo Finance).

The number may change, but the principle won't

The appeal means the €825 million figure is not final. Courts could uphold, reduce, or annul it entirely. The full AP decision had not been published when the story broke, so the exact calculation remains opaque (Boursorama/AFP). Uber's earlier €290 million Dutch fine for transferring driver data to the US was reportedly stayed during appeal, suggesting this one could be too (DutchNews).

The bigger signal matters beyond Uber. Millions of platform workers now have software, not a manager, deciding whether they can earn on a given day. The GDPR is already being used to police how platforms manage workers by algorithm, even before newer legislation like the EU's AI Act (which classifies workplace AI as high-risk, requiring extra oversight) or the Platform Work Directive (which will give gig workers stronger rights to challenge automated decisions) becomes the main battleground (Deutschlandfunk, AI Act, Regulation 2024/1689). Each pushes platforms toward the same rule: software can assist a workplace decision, but it cannot be the only accountable actor.

For anyone who depends on a platform for income, the practical takeaway is already clear. If an algorithm blocks your account, you have the right to know what data and logic were used, to have a real person review the decision, and to contest it. Whether a court ultimately charges Uber €825 million or €82 million for ignoring those rights, the rights themselves are not going away.