Dutch regulator fines Uber EUR 824,990,000 over automated driver deactivations
The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), has fined Uber EUR 824 990 000 for unlawful automated decision-making about drivers and for not informing them sufficiently about profiling. The regulator found that Uber violated the GDPR's prohibition of fully automated decision-making.
- The Dutch AP fined Uber EUR 824 990 000 under the GDPR.
- Drivers' accounts were automatically deactivated over suspected fraud or low customer ratings, causing lost income.
- The AP also found Uber did not sufficiently inform drivers about the automated decision-making.
- The case began with complaints from 171 French drivers and covers incidents between 2018 and 2022.
- According to the EDPB, Uber has since stopped the violations.
What the regulator found
According to the summary published by the European Data Protection Board (EDPB), the AP ruled that Uber made fully automated decisions about drivers. When fraud was suspected, or when customer ratings were too low, drivers' accounts were automatically deactivated temporarily. In cases of persistent low customer ratings, accounts were deactivated permanently.
As a result, drivers lost the income they earned through Uber during the deactivation. The AP concluded that this practice breached the GDPR's ban on fully automated decision-making. The legal basis cited is Article 22, which covers automated individual decision-making, including profiling.
The authority also found that Uber did not sufficiently inform drivers about the automated decision-making. This part of the case relates to Article 13 of the GDPR, which sets out the information that must be provided when personal data are collected from the data subject.
How the case began
The investigation started with complaints from 171 French Uber drivers. They submitted them through the Ligue des droits de l'Homme (LDH) to the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL).
Because Uber's European headquarters are in the Netherlands, the Dutch AP handled the case under the GDPR One-Stop-Shop procedure. The case concerned incidents between 2018 and 2022.
Outcome and what it signals
The AP imposed an administrative fine of EUR 824 990 000. The EDPB notes that Uber has since stopped the violations. The decision is listed as a cross-border case.
The ruling shows that a European regulator treats account deactivations driven by fraud suspicions and customer ratings as fully automated decisions covered by the GDPR, particularly where they cut off a person's income. For platforms that rely on automated systems to manage workers, the decision underlines the obligation to tell people clearly how such systems affect them.
The EDPB page also lists other recent enforcement items, including a EUR 403 000 000 fine imposed by the Irish Data Protection Commission on Google over its processing of location data, announced on 23 September 2026.
