Uber algorithm draws €825 million fine

A driver opens the Uber app in the morning and finds the account blocked. The system has marked something as suspicious: perhaps a route it treated as fare inflation, perhaps a run of poor passenger ratings. There is no warning letter, no phone call, no person who has looked at the file. Just a screen saying the driver cannot work.

That is the kind of decision now at the centre of an €825 million fine imposed on Uber this week by the Dutch Data Protection Authority, the AP. It is the second-largest penalty ever issued under European privacy law, after Meta’s €1.2 billion sanction in 2023 (Reuters via Yahoo Finance, DutchNews). The Dutch regulator found that Uber used software to suspend or permanently remove drivers across Europe without giving them proper information or meaningful human review (NOS, Euractiv).

For Malta, this is not a distant Dutch privacy story. It is a warning about the kind of digital labour market we are also building, from ride-hailing and delivery work to platform services used by self-employed people who may have little bargaining power when an app becomes their real employer.

The law that says a computer can't decide alone

The legal lever is Article 22 of the GDPR, the EU’s data protection regulation. It gives people the right not to be subjected to decisions made solely by software when those decisions have a serious effect on their lives (GDPR official text). A personalised advert does not meet that threshold. Losing access to your income does.

The line is practical. Software may rank rides, detect patterns or flag behaviour for review. Once income, legal status or livelihood is at stake, the GDPR requires three things: a human being must genuinely assess the case, the person affected must be told what data and reasoning were used, and there must be a workable way to challenge the decision (GDPR official text, EDPB-endorsed guidance).

“Human review” is not a clerk pressing confirm on a dashboard. European guidance says the reviewer must understand the software’s output, see the underlying data, and have the authority to overturn the decision (EDPB-endorsed guidance).

The AP’s deputy chair, Monique Verdier, put the point simply: drivers were made inactive without warning, and a computer should not independently make decisions with major consequences before a human being has assessed them (Xinhua).

French drivers, Dutch fine

The case began with complaints from French Uber drivers, reportedly involving 171 complainants, although the original complaint filing has not surfaced publicly (Boursorama/AFP, Le Figaro/AFP). Under the GDPR’s cross-border system, the regulator in the country where a company has its EU headquarters normally leads the case. Uber’s European base is in Amsterdam, so the Dutch authority took charge. That is how complaints by drivers in France became a Europe-wide enforcement decision (NRC).

This mechanism matters for small member states. Malta often experiences EU regulation through regulators elsewhere, especially when large platforms base key operations in another member state. A Maltese worker, consumer or business may be affected by a decision taken in Amsterdam, Dublin or Luxembourg because the company’s European legal centre sits there.

The AP found that Uber’s systems flagged drivers for suspected fraud or low ratings and suspended accounts without adequate explanation or an effective right of challenge. Uber contests key parts of that finding. It says permanent deactivations were not fully automated and that only 126 European drivers were deactivated in 2021 over low customer ratings (Reuters via Yahoo Finance, Quartz). The company calls the fine “disproportionate”, says the practices under investigation were discontinued years ago, and has confirmed it will appeal (Bloomberg via Yahoo Finance).

The number may change, but the principle won't

The appeal means the €825 million figure is not final. A court could uphold it, reduce it, or annul it. The AP’s full decision had not been published when the case broke, so the calculation behind the amount is still unclear (Boursorama/AFP). Uber’s earlier €290 million Dutch fine for transferring driver data to the US was reportedly suspended while under appeal, and the same could happen here (DutchNews).

The signal is larger than Uber. Millions of platform workers now have software, rather than a manager, deciding whether they can earn on a particular day. The GDPR is already being used to police algorithmic management before newer laws become the main battlefield. The EU’s AI Act classifies workplace AI as high-risk, meaning it requires tighter oversight. The Platform Work Directive will give gig workers stronger rights to challenge automated decisions (Deutschlandfunk, AI Act, Regulation 2024/1689).

All three instruments point in the same direction. Software may help a company make a workplace decision, but it cannot be the only actor with power over someone’s livelihood.

For anyone depending on a platform for income, the practical point is already clear. If an algorithm blocks your account, you have the right to know what data and logic were used, to have a real person review the decision, and to contest it. Whether the final bill for Uber is €825 million or €82 million, those rights are now firmly part of Europe’s labour and data protection landscape.