Uber Algorithm Draws €825 Million Fine

A driver opens the Uber app in the morning and finds the account has been blocked. The software has seen something it does not like: perhaps a route it reads as fare inflation, perhaps a spell of poor passenger ratings. There is no warning letter, no phone call, no person explaining the decision. Just a screen telling the driver there is no work today.

That is the human problem behind the €825 million fine imposed on Uber this week by the Dutch Data Protection Authority (AP), the second-largest penalty yet under European privacy law after Meta’s €1.2 billion sanction in 2023 (Reuters via Yahoo Finance, DutchNews). The Dutch regulator found that Uber used software to suspend or permanently remove drivers across Europe without giving them proper information or a meaningful human review (NOS, Euractiv).

The law that says a computer can't decide alone

The lever is Article 22 of the GDPR, the EU’s data protection regulation. It gives people the right not to be subject to decisions made solely by software where those decisions have a serious effect on their lives (GDPR official text). A personalised advert does not meet that threshold. Being cut off from your income does.

The rule draws a practical line. Software can still rank rides, price journeys or flag suspicious patterns. But when a person’s earnings or legal position is at stake, three protections apply: a human must properly review the case, the person must be told what data and reasoning drove the decision, and there must be a workable route to challenge it (GDPR official text, EDPB-endorsed guidance). A staff member pressing "confirm" on a dashboard is not enough. European guidance says the reviewer must understand the software’s output, see the underlying data, and have the authority to overturn it (EDPB-endorsed guidance).

Monique Verdier, the AP’s deputy chair, put the point plainly: drivers were made inactive without warning, and a computer should not make decisions with major consequences before a person has looked at them (Xinhua).

French drivers, Dutch fine

The case began with complaints from French Uber drivers, reportedly involving 171 complainants, though the original complaint filing has not surfaced publicly (Boursorama/AFP, Le Figaro/AFP). Under the GDPR’s cross-border system, the regulator in the country where a company has its EU headquarters usually leads. Uber is based in Amsterdam, so the Dutch authority took charge. That is how complaints from drivers in France became a Europe-wide enforcement case (NRC).

The AP found that Uber’s systems flagged drivers for suspected fraud or low ratings and suspended accounts without enough explanation or an effective appeal route. Uber contests central parts of that finding. It says permanent deactivations were not fully automated and that only 126 European drivers were deactivated in 2021 over low customer ratings (Reuters via Yahoo Finance, Quartz). The company calls the fine "disproportionate", says the practices under investigation ended years ago, and will appeal (Bloomberg via Yahoo Finance).

The number may change, but the principle won't

The appeal means the €825 million penalty is not settled. A court could uphold it, reduce it or throw it out. The full AP decision had not been published when the story broke, so the regulator’s calculation is still unclear (Boursorama/AFP). Uber’s earlier €290 million Dutch fine for transferring driver data to the US was reportedly stayed during appeal, and this one could follow the same path (DutchNews).

The signal reaches well beyond Uber. Across Europe, including Ireland, platform workers increasingly deal with software as their day-to-day manager. An app allocates work, scores performance and, in the most serious cases, decides whether a person can earn at all. The GDPR is already being used to police that relationship, even before newer laws such as the EU AI Act, which classifies workplace AI as high-risk, and the Platform Work Directive, which will strengthen gig workers’ rights to challenge automated decisions, become the main arena (Deutschlandfunk, AI Act, Regulation 2024/1689). The direction of travel is clear: software can inform a workplace decision, but it cannot be the only accountable actor.

For anyone who depends on a platform for income, the practical meaning is already visible. If an algorithm blocks your account, you have the right to know what data and logic were used, to have a real person review the decision, and to contest it. Whether the courts ultimately leave Uber with an €825 million bill or a much smaller one, those rights are now firmly in play.