Uber is facing an €825 million fine from the Dutch Data Protection Authority after the regulator found that the company breached European data protection rules when using automated systems to suspend or deactivate drivers.
The penalty would rank as the second-largest fine imposed under the General Data Protection Regulation, behind the €1.2 billion penalty issued to Meta in Ireland in 2023. Uber has said it will appeal the Dutch decision.
The dispute centres on how Uber used computer systems to identify suspected fraud and assess driver performance. Some drivers had their accounts temporarily suspended after automated checks flagged behaviour such as taking unnecessary detours that could increase fares or accepting trips without completing them.
Uber said temporary suspensions were generally short and that permanent deactivations were not made without human involvement. The Dutch regulator, however, said some drivers with low customer ratings were permanently removed from the platform through automated decisions.
Uber rejected that finding, saying it had never used automated systems to permanently deactivate drivers. The company also argued that the penalty was disproportionate because relatively few drivers were affected. It said 126 European drivers were deactivated because of low customer ratings in 2021.
The Dutch regulator said Uber had violated drivers’ rights under GDPR, particularly protections against decisions based solely on automated processing when those decisions have significant consequences.
European data protection rules require meaningful human involvement in such cases and give individuals the right to understand how decisions affecting them are made and challenge those decisions.
The Dutch authority also found that Uber failed to provide adequate information about its use of automated decision-making.
The case has implications beyond Uber because automated screening is increasingly used by companies to assess workers, contractors, customers and sellers. Businesses using fraud detection, identity checks, ratings systems or other automated tools can face similar obligations when those systems have a significant effect on individuals.
Although the UK is no longer part of the EU, similar protections remain under the UK GDPR. British rules provide people with safeguards against certain decisions made entirely through automated processing and allow them to request human intervention and challenge decisions.
Uber has already faced disputes in Britain involving automated facial verification systems used to check drivers. The company has also dealt with legal claims over the employment status of its drivers.
The Dutch penalty comes amid wider tensions between European regulators and major US technology companies. Large European fines against American firms have become a source of friction in transatlantic economic relations.
Uber said it strongly disagreed with the Dutch decision and described the fine as disproportionate. The company said it takes driver rights seriously and provides human reviews and opportunities for drivers to challenge account suspensions.
