Dutch privacy regulator hits Uber with €825 million GDPR fine over automated driver deactivations
Uber is facing a major privacy penalty in Europe after the Dutch Data Protection Authority imposed an €825 million fine, equal to roughly $966 million, over concerns about how the company handled driver account deactivations. The penalty is one of the largest ever issued under the European Union’s General Data Protection Regulation, better known as GDPR.
The case centers on allegations that Uber deactivated some driver accounts through automated decision-making systems without giving drivers enough warning, clear explanations, or meaningful human oversight. Dutch officials said the company’s process had serious consequences for drivers, many of whom rely on the platform as a major source of income.
Monique Verdier, deputy chair of the Dutch Data Protection Authority, said Uber had committed “serious infringements,” stressing that important decisions affecting people’s livelihoods should not be left entirely to automated systems.
“A computer should not make decisions on its own that have such major consequences,” Verdier said.
Uber rejects the regulator’s findings and says it plans to appeal the decision. The company argues that most driver suspensions are temporary and that permanent account deactivations do not happen without human review. Uber also says drivers have access to an appeals process if they believe a suspension or deactivation was unfair.
Dutch regulators, however, said their investigation found cases in which drivers were permanently removed from the platform without proper human involvement. Uber disputes that claim.
The complaint that led to the investigation was brought forward by drivers who said they were unfairly removed from the platform and struggled to understand why. One of the key figures in the case is Brahim Ben Ali, a former Uber driver in France. After his own account was deactivated in 2019, he gathered testimony from around 170 other drivers and helped bring the complaint to the Netherlands, where Uber’s European headquarters are based.
The drivers were supported by PersonalData.io, a Swiss nonprofit focused on digital rights. The organization helped them request and analyze data related to Uber’s account deactivation decisions.
Paul-Olivier Dehaye, founder of PersonalData.io, said the impact of a single complaint against a driver can be severe, even after a long record of successful trips. He noted that a driver may complete hundreds or thousands of rides with satisfied passengers, but one serious report can trigger consequences that are difficult to challenge or even understand.
This is not the first time Uber has faced enforcement action from the Dutch privacy regulator. The company was previously fined €290 million over the handling of drivers’ personal data and €10 million in a related case. Dehaye said the fines stem from complaints involving the same group of drivers.
The issue also raises a broader debate about the role of algorithms in the gig economy. Platforms such as Uber often use automated systems to detect fraud, monitor performance, flag safety concerns, and manage access to work. Supporters of automation argue that these systems can help protect customers and improve platform reliability. Critics say they can become opaque, unfair, and difficult to challenge when people’s income is at stake.
Some observers have questioned whether the fine could limit Uber’s ability to monitor drivers who may be violating platform rules, such as failing to pick up passengers or attempting to scam customers. But digital rights advocates argue that the case is not about banning Uber from taking action against misconduct. Instead, they say the company must ensure that major decisions are transparent, accountable, and subject to real human review.
Dehaye said Uber can still discipline drivers who break rules, but it must take responsibility for those decisions rather than presenting itself only as a neutral marketplace. That distinction is especially important in ongoing debates about whether gig economy platforms act like employers while avoiding many of the responsibilities that traditional employers carry.
The case could have significant consequences for platform workers across Europe. Under GDPR, individuals have protections against decisions made solely by automated processing when those decisions have major legal or personal effects. Regulators are increasingly examining how companies use algorithms to manage workers, customers, and access to essential services.
For Uber, the €825 million fine adds to a growing list of legal and regulatory challenges involving data protection, labor rights, and platform accountability. For drivers, the decision may strengthen demands for clearer explanations, fairer appeals, and greater transparency when their accounts are suspended or permanently deactivated.
Uber’s appeal will determine whether the fine stands, is reduced, or is overturned. But regardless of the outcome, the case has already become a major test of how European privacy law applies to automated decision-making in the gig economy.
