Dutch DPA fines Uber €825M over automated driver deactivations
TL;DR
- The complaint was filed with CNIL in 2020 by 171 French drivers via Ligue des droits de l'Homme, not by any regulator acting independently.
- CNIL co-enforced alongside the Dutch DPA throughout checks and evidence analysis, establishing a replicable cross-border Article 22 enforcement template.
- The fine equals roughly 1.85% of Uber's €44.5B 2025 global revenue, well below GDPR's 4% statutory ceiling, signaling room for larger future penalties.
The Dutch Data Protection Authority has fined Uber €825 million (about $966 million) for suspending and deactivating driver accounts through automated systems without adequate human oversight, TechCrunch reported. It is the second-largest GDPR penalty on record, behind only the €1.2 billion Ireland levied on Meta in 2023.
The regulator's framing was blunt. "A computer should not make decisions on its own that have [such] major consequences," said Deputy Chair Monique Verdier. Between 2018 and 2022, Uber used software to monitor driver behaviour and customer ratings, temporarily suspending accounts when fraud was suspected and, in some cases, permanently deactivating accounts with consistently low ratings. The AP says those calls were made without sufficient human assessment.
Uber is fighting the finding. "We strongly disagree with this decision and disproportionate fine," an Uber spokesperson said, arguing that most suspensions are temporary and that permanent deactivations require human review. The company plans to appeal.
The complaint that produced the fine began with one person. Former French Uber driver Brahim Ben Ali collected testimonies from 170 drivers after his own 2019 account deactivation and filed in the Netherlands, where Uber's European headquarters sit, with help from the nonprofit PersonalData.io. "If just one person reports a very serious problem, the consequences can be enormous," said founder Paul-Olivier Dehaye, who is launching a new company, StartClaims, to support driver compensation litigation.
This is the third Dutch penalty against Uber, following earlier fines of €290 million and €10 million for driver data handling. The case joins 273 regulation stories in our tracker over the last 90 days.
What others are reporting
-
CNIL Read →
CNIL documents its co-enforcement role and the complaint's origin from 171 French drivers, showing how GDPR's one-stop-shop channeled a 2020 civil-rights filing into the €825M fine.
Deactivations constitute automated individual decisions due to complete absence of human intervention in the decision-making process.
-
The Guardian Read →
Frames the fine within a broader European pattern of multi-billion penalties on US tech companies across privacy, competition, and digital market rules.
European regulators have imposed billions in penalties on US technology companies due to privacy, competition and digital market rules.
-
MLex Read →
Specialist legal coverage notes the appeal could take several years to exhaust and places the fine within EU data protection enforcement trends for ongoing compliance tracking.
Uber failed to provide drivers with sufficient information about the reasons for the deactivations, preventing them from properly understanding and challenging the decisions.
-
Yahoo Finance Read →
Investor lens frames the fine as a margin-pressure compliance cost and flags Article 22 scrutiny as a forward risk for Uber's autonomous vehicle automation strategy.
The regulator found that Uber's systems lacked sufficient human oversight and due process when deactivating driver accounts.
Originally reported by techcrunch.com
Read the original article →Original headline: Dutch Regulator Fines Uber €825M for Algorithmic Driver Deactivations, Second-Largest GDPR Penalty Ever