Netherlands Fines Uber €825 Million Over Driver-Blocking Algorithm

The Dutch data protection authority, Autoriteit Persoonsgegevens (AP), has fined Uber 825 million euros. The penalty targets automated systems that blocked and deleted driver accounts without meaningful human oversight of decisions affecting the earnings of thousands of people.

What the regulator found

The Autoriteit Persoonsgegevens determined that between 2020 and 2022, Uber used automated systems to temporarily or permanently deactivate driver accounts in the Netherlands. The key accusation is that decisions to cut someone off from their ability to earn money were made without sufficient transparency about how the algorithm actually worked, and without real human involvement in many cases.

The regulator identified two main mechanisms behind the system. The first was fraud-suspicion detection, for example flagging drivers who deliberately chose longer routes to inflate a fare, an assessment the algorithm made on its own. The second was the automatic and permanent removal from the platform of drivers who accumulated too many low ratings from passengers.

We strongly disagree with this decision and with the disproportionate size of the fine - Uber

The right to a human decision

The case touches one of the central mechanisms of EU data protection law. GDPR rules restrict the ability to make fully automated decisions that produce a significant legal effect or similarly significantly affect a person. Anyone subject to such a decision must be able to challenge it and obtain human intervention.

For a driver on an earnings platform, account deactivation means an immediate loss of income, often without a clear explanation of the reason and without a real path to appeal. The Dutch regulator concluded that Uber failed to provide these safeguards to a sufficient degree for years.

Uber's response

The company disputes the regulator's findings. Uber says it never decided to permanently remove a driver without human involvement, and that most suspensions were short-term. The company also cited its own figures, saying that in 2021 a relatively small number of driver accounts were deactivated across Europe due to low ratings.

Uber says decisions to block accounts are now reviewed by employees, and that drivers can appeal them. The company has said it will appeal the Dutch regulator's decision, meaning a final resolution of the case could still take years.

Where it ranks among GDPR fines

The 825 million euro fine, if upheld, would become the second-highest sanction in GDPR history. The record belongs to Meta, which in 2023 paid 1.2 billion euros imposed by the Irish regulator for the unlawful transfer of European Facebook users' data to the United States. Meta also appealed that decision.

Placing the two cases side by side shows the growing willingness of European regulators to penalize technology companies over large-scale automated decision-making, whether it involves data transfers or the algorithmic management of a workforce.

Implications for platform labor

The case matters beyond Uber itself. Algorithmic management models, in which a system automatically rates, rewards and penalizes platform workers, are standard across the ride-hailing and delivery industry throughout the European Union, including in Poland. The Dutch regulator's decision could set a precedent affecting how other platforms design their rating and account-deactivation systems.

The European Union has also been working for some time on separate rules on platform work meant to directly regulate the automated management of workers by algorithms. The Uber case shows that even without those detailed rules, existing data protection law already gives regulators the tools to penalize companies for opaque decision-making systems.