Tauseef Sarwar
The Dutch data protection authority has fined Uber nearly 825 million euros, one of the largest privacy penalties ever issued in Europe, for letting software deactivate drivers’ accounts without a human checking the decision first. The Autoriteit Persoonsgegevens (AP) found that between 2018 and 2022, Uber’s systems automatically suspended or permanently blocked drivers over fraud suspicions or low customer ratings, in violation of the GDPR’s ban on fully automated decisions that significantly affect people.
How the system worked
According to the AP’s own published decision, Uber’s fraud-detection and rating systems could flag a driver, temporarily freeze the account, and in cases of persistently low reviews, deactivate it permanently, all without a human reviewing the underlying evidence first. Drivers were not adequately told that an automated system, rather than a person, had made the call. The investigation traces back to complaints filed by 171 French Uber drivers; because Uber’s European headquarters sits in the Netherlands, the AP handled the case as lead regulator under the GDPR’s one-stop-shop mechanism.
Where it ranks among privacy fines
At just under 825 million euros, the penalty is the second-largest GDPR fine on record, behind only the 1.2 billion euro fine Ireland’s regulator imposed on Meta in 2023, according to Dutch outlet Security.NL’s reporting on the decision. Uber has said it will appeal, and the fine is suspended while that process runs. The company disputes the AP’s characterization and maintains that permanent deactivations always involved a human reviewer.
A familiar pattern beyond ride-hailing
Ride-hailing apps are not the only platforms that let software make calls about who gets to keep earning. Freelance marketplaces route a similar mix of decisions, account suspensions, visibility penalties, dispute rulings, through automated trust-and-safety systems with limited human review, and a freelancer in Lahore or Dubai whose account gets flagged has no equivalent of the GDPR to point to. The AP’s decision does not reach outside the EU and does not touch contractor platforms directly, but it sets a legal marker that regulators elsewhere, including California with its new No Robo Bosses Act, are starting to follow in their own way.
Whether that marker ever extends to the freelance marketplaces millions of people in Pakistan and the Gulf rely on is still an open question, and for now the burden of proving a wrongful account suspension still falls almost entirely on the worker.
