Dutch DPA Fines Uber €825 Million Over Automated Driver Deactivations
The Dutch Data Protection Authority has fined Uber €825 million for using automated systems to deactivate driver accounts without adequate information or human review; Uber says it will appeal. The penalty is the second-largest GDPR fine to date, and the decision centers on whether temporary and permanent deactivation decisions required meaningful human involvement. Uber disputes that permanent deactivations were automated and cites 126 affected drivers in Europe in 2021, while the DPA views the automated process itself as the infringement.
1 source74% confidence
72Strategic
Strategic score
Evidence strength62
Technical novelty55
Commercial potential45
strategyresearchevidencenovelty
The Dutch Data Protection Authority has fined Uber €825 million ($966 million) for deactivating driver accounts through automated systems without adequately informing drivers or providing human review, a decision Uber says it will appeal.1
This is the second-largest GDPR fine to date, but the novelty is not the amount. The DPA's statement—'a computer should not make decisions on its own that have such major consequences'—applies GDPR Article 22 to the gig-economy practice of algorithmic account deactivation, making procedural transparency and human involvement the central compliance question.1
The constraint that moved is the boundary between automated fraud detection and a 'decision' under EU data protection law. Uber's systems may flag suspicious trips; the DPA treats the resulting suspension—even when brief and later reviewed—as a decision with significant effects that requires meaningful human review and a way to challenge it. The fine therefore shifts attention from whether the fraud detection was accurate to whether a human was involved in the loop and how drivers were informed.1
AI hypothesisWhat would change this assessment: if Uber's appeal produces evidence that every disputed deactivation—including the 126 attributed to low customer ratings—received meaningful human review before effect, the DPA's central factual claim weakens. Conversely, confirmation that any driver was deactivated without such review would solidify the precedent.1
The Dutch Data Protection Authority has fined Uber €825 million ($966 million) for deactivating driver accounts through automated systems without adequately informing them, according to an August 17 decision reviewed by Reuters. The penalty would be the second-largest issued yet under Europe’s General Data Protection Regulation. It is behind only a €1.2 billion fine imposed on Meta by Ireland in 2023 for unlawfully transferring European Facebook users’ data to the United States. Meta is appealing. Uber said it would also appeal. [...] The Dutch authority confirmed the decision later on Friday. “Uber has committed serious infringements,” in deactivating driver accounts without warning or human involvement, the organisation’s deputy chair Monique Verdier said in a statement. “From one moment to the next they no longer had any income ... A computer should not make decisions on its own that have (such) major consequences.”
This really takes the cake:
GDPR rules ban decisions made solely by computer algorithms when they have a significant impact on people’s lives, saying such decisions require meaningful human review and a way to challenge a decision. Uber temporarily suspended accounts of some drivers who were suspected of fraud, including when its systems concluded drivers had taken unnecessary detours to inflate fares or accepted trips without intending to complete them. Uber said such suspensions were usually brief, and it did not permanently deactivate such accounts without human review. Drivers with low customer ratings were sometimes permanently deactivated by computer, the Dutch agency said. Uber disputed that, saying it had never automated permanent deactivation decisions. The company said one reason it considers the fine disproportionate is that only a small number of drivers were affected, with 126 having been deactivated in Europe as a result of low customer ratings in 2021.
It’s possible that Reuters’s reporting is incomplete, but there’s no allegation here that the grounds for these suspensions were incorrect. Uber suspended drivers who were pulling long-haul scams against customers to run up fare prices, and doing the annoying thing where they accept a ride and then never show up, hoping the customer will eventually get frustrated and cancel the trip themselves. (My understanding is that drivers do this when they’re driving for, say, both Uber and Lyft. They’ll accept a ride from Uber and then if a more appealing offer comes from Lyft, they’ll accept that one too and just never pick up the customer they accepted from Uber.)
Per this fine, it’s unlawful in the EU for Uber to monitor its drivers for pulling scams against customers, or just never picking riders up, leaving them stranded. I mean, I’m not a member of the “Uber Labor Practices” fan club, but one of the best things about Uber compared to taxis is that they monitor for and take action against scam drivers.
This isn’t a two-sided conflict between employees (drivers) and a big corporation (Uber). It’s three-sided. Where does customer experience factor into this? The drivers were scamming customers, and Uber took action to stop it. This sounds to me like a system that works. The EU regulation doesn’t seem to factor in customers at all.
Toby Sterling, reporting for Reuters:
The Dutch Data Protection Authority has fined Uber €825 million ($966 million) for deactivating driver accounts through automated systems without adequately informing them, according to an August 17 decision reviewed by Reuters. The penalty would be the second-largest issued yet under Europe’s General Data Protection Regulation. It is behind only a €1.2 billion fine imposed on Meta by Ireland in 2023 for unlawfully transferring European Facebook users’ data to the United States. Meta is appealing. Uber said it would also appeal. [...] The Dutch authority confirmed the decision later on Friday. “Uber has committed serious infringements,” in deactivating driver accounts without warning or human involvement, the organisation’s deputy chair Monique Verdier said in a statement. “From one moment to the next they no longer had any income ... A computer should not make decisions on its own that have (such) major consequences.”
This really takes the cake:
GDPR rules ban decisions made solely by computer algorithms when they have a significant impact on people’s lives, saying such decisions require meaningful human review and a way to challenge a decision. Uber temporarily suspended accounts of some drivers who were suspected of fraud, including when its systems concluded drivers had taken unnecessary detours to inflate fares or accepted trips without intending to complete them. Uber said such suspensions were usually brief, and it did not permanently deactivate such accounts without human review. Drivers with low customer ratings were sometimes permanently deactivated by computer, the Dutch agency said. Uber disputed that, saying it had never automated permanent deactivation decisions. The company said one reason it considers the fine disproportionate is that only a small number of drivers were affected, with 126 having been deactivated in Europe as a result of low customer ratings in 2021.
It’s possible that Reuters’s reporting is incomplete, but there’s no allegation here that the grounds for these suspensions were incorrect. Uber suspended drivers who were pulling long-haul scams against customers to run up fare prices, and doing the annoying thing where they accept a ride and then never show up, hoping the customer will eventually get frustrated and cancel the trip themselves. (My understanding is that drivers do this when they’re driving for, say, both Uber and Lyft. They’ll accept a ride from Uber and then if a more appealing offer comes from Lyft, they’ll accept that one too and just never pick up the customer they accepted from Uber.)
Per this fine, it’s unlawful in the EU for Uber to monitor its drivers for pulling scams against customers, or just never picking riders up, leaving them stranded. I mean, I’m not a member of the “Uber Labor Practices” fan club, but one of the best things about Uber compared to taxis is that they monitor for and take action against scam drivers.
This isn’t a two-sided conflict between employees (drivers) and a big corporation (Uber). It’s three-sided. Where does customer experience factor into this? The drivers were scamming customers, and Uber took action to stop it. This sounds to me like a system that works. The EU regulation doesn’t seem to factor in customers at all.
The source text above remains the property of its publisher and is reproduced for commentary.