The Dutch Data Protection Authority fined Uber €825 million, or approximately $966 million, over the way the company handled decisions to suspend driver accounts. According to Reuters, the penalty is the second-largest fine issued so far under Europe’s General Data Protection Regulation (GDPR).
The decision followed an investigation into complaints that Uber deactivated drivers’ accounts through an automated process, without sufficient warning or appropriate human oversight. The authority’s vice president, Monique Verdier, said the company had committed “serious violations,” adding that a computer should not make decisions on its own when they have consequences this serious.
Dispute over the role of human review
Uber says most suspensions are short-term and that no permanent deactivation occurs without human review. It also says drivers can file appeals. But the Dutch regulator said some drivers’ accounts were permanently deactivated without human review, a claim the company rejects.
Uber said it “strongly disagrees” with the decision, considers the fine disproportionate, and announced that it would appeal it. As a result, the fine does not at this stage represent a final, unappealable judgment, and the details of the cases on which the authority relied will remain a focus of the dispute between the two sides.
Drivers’ complaints reached the regulator
According to the article, the case began with Brahim Ben Ali, a former Uber driver in France. After his account was deactivated in 2019, he collected testimonies from 170 other drivers and then brought the complaint to the Netherlands, where Uber’s European headquarters is located.
Ben Ali received assistance from the Swiss digital rights organization PersonalData.io, which helped drivers collect data on how deactivation decisions were made. The organization’s founder, Paul-Olivier Dehaye, said a driver might complete 1,000 trips to customers’ satisfaction, but a single report of a serious problem could lead to major consequences.
According to Dehaye, this is the third fine the Dutch authority has imposed on Uber, following a €290 million fine over the way it handled drivers’ personal data and another €10 million fine related to connected issues. He also said he planned to launch a class action allowing drivers to seek compensation.
Why does this matter?
The case reveals the limits of using automated systems to manage work platforms, particularly when a decision cuts off someone’s source of income or prevents them from accessing their account. The dispute is not only about Uber’s ability to detect fraud or misconduct, but also about who bears responsibility for the final decision, how the driver is informed of it, and whether the driver is enabled to appeal.
Dehaye believes Uber can use people to punish drivers who defraud customers, but that doing so would make the company responsible for the decision as an entity making consequential decisions, rather than allowing it to present itself merely as a marketplace or intermediary. By contrast, John Gruber argued that account suspensions are carried out according to policies established by management and that the devices do not make decisions independently of the company.
The case adds regulatory and legal pressure on business models that rely on automated ratings and continuous monitoring, but it does not by itself establish that every use of such systems is unlawful. The point requiring follow-up is how the decision will be interpreted on appeal and whether potential class claims will result in compensation or additional obligations for Uber.