The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) has imposed an €825 million fine on ride-hailing giant Uber for unlawfully deactivating drivers’ accounts through automated decision-making processes. The penalty ranks among the highest ever handed down under the EU’s General Data Protection Regulation (GDPR).
Automated deactivations without proper safeguards
According to the AP’s investigation, between early 2021 and mid-2024 Uber relied on automated systems to suspend or terminate drivers’ accounts when certain thresholds—such as low ratings or flagged trips—were exceeded. Drivers received little to no explanation for these actions and were unable to meaningfully challenge the deactivations, in breach of GDPR rules on transparency, human intervention and the right to contest automated decisions.
Key findings of the AP investigation
- Lack of human oversight: Automated processes led to immediate account suspensions without a manual review of the surrounding circumstances.
- Insufficient explanations: Drivers were provided generic notifications referring vaguely to “policy violations,” with no clear information on the specific grounds for deactivation.
- No real appeal mechanism: Although Uber offered an online appeals portal, the AP found the process failed to deliver substantive reviews or timely resolutions.
Uber’s response and next steps
Uber has announced its intention to appeal the decision before the Trade and Industry Appeals Tribunal (College van Beroep voor het bedrijfsleven). A spokesperson asserted that “Uber continuously invests in robust processes to protect drivers’ rights and enable fair review of account issues,” and that the company is already rolling out enhanced transparency measures across Europe.
The AP has given Uber three months to comply by implementing a human-in-the-loop review for any automated account suspension and by providing detailed, personalized explanations to drivers. Failure to meet these requirements could trigger additional sanctions.
Implications for the gig economy
This landmark ruling underscores growing regulatory scrutiny of algorithm-driven management practices in the gig economy. Privacy and labour advocates have long warned that automated systems can strip workers of due process, while tech platforms argue they are necessary to maintain service quality and safety.
With similar investigations underway in other EU member states, the AP’s decision against Uber may set a precedent ensuring that gig-economy firms incorporate robust human oversight and uphold data protection rights when deploying algorithmic tools.
