Dutch DPA fines Uber €824,990,000 over automated driver deactivations

What happened

• The Autoriteit Persoonsgegevens imposed a €824,990,000 administrative fine on Uber for violating the GDPR prohibition on fully automated decision‑making and for failing to inform drivers about profiling.
• The violations stemmed from automatic temporary or permanent deactivation of driver accounts based on fraud suspicions or low customer ratings from 2018 to 2022.
• Complaints by 171 French drivers triggered the investigation under the GDPR One‑Stop‑Shop procedure.
• Uber has ceased the offending practices but has appealed the fine, and no final judicial decision has been made.

Why it matters

Ride‑hailing platforms that use algorithmic driver deactivation must audit their automated decision systems and ensure transparent notices to avoid similar penalties.

Business impact

Companies will need to redesign deactivation workflows to include human review and update privacy notices, potentially incurring legal and technical costs.

What to check

1. 1

   Audit automated decision processesHigh priority

   Identify any fully automated actions affecting drivers and assess GDPR compliance.

2. 2

   Add transparent information on profilingHigh priority

   Update privacy notices to clearly explain automated decision logic and driver rights.

3. 3

   Implement human oversightHigh priority

   Introduce manual review steps before permanent deactivation of driver accounts.

4. 4

   Document compliance measuresMedium priority

   Maintain records of the audit, notices, and oversight mechanisms for regulator review.