The Dutch Data Protection Authority has fined Uber €825 million ($966 million) for deactivating driver accounts through automated systems without adequately informing them, in what stands as the second-largest penalty ever issued under Europe’s General Data Protection Regulation.
The decision, dated August 17 and first reported by Reuters, found that Uber violated GDPR by using automated decision-making to suspend or deactivate driver accounts without providing sufficient transparency about the process or offering meaningful recourse to affected drivers.
What the Regulator Found
The Dutch DPA determined that Uber’s automated systems were used to deactivate driver accounts – effectively cutting off their livelihood – without adequately informing drivers about the decisions being made on their behalf. Under GDPR, individuals have the right to be informed about automated decisions that significantly affect them, and to contest such decisions.
The fine is the second-largest GDPR penalty on record, trailing only the €1.2 billion ($1.3 billion) fine that Ireland’s Data Protection Commission imposed on Meta in May 2023 for transferring EU user data to the United States. It adds to a growing list of regulatory actions against Uber across Europe, including a €600 million fine from the Dutch DPA in 2023 for transferring European driver data to the U.S.
Gig Economy Under the Microscope
The penalty sends a clear signal to the gig economy sector that automated systems affecting workers’ livelihoods must meet GDPR’s transparency requirements. As more companies deploy AI-driven management tools, regulators across Europe are watching closely to ensure these systems comply with data protection rules.
Labor groups and driver advocates have long argued that platforms use opaque algorithms to make consequential decisions about driver access without transparency or appeal. The Dutch regulator’s decision validates those concerns and could set precedent for similar cases against other ride-hailing and delivery platforms operating in Europe.
The fine specifically targets Uber’s use of algorithmic decision-making in its gig economy operations, an area of increasing regulatory scrutiny as automated systems play a larger role in managing gig workers across the continent. The case underscores how GDPR’s provisions on automated decision-making are being applied to workplace-adjacent algorithms, not just traditional data processing.
Uber has the right to appeal the decision. The company did not immediately respond to requests for comment on the fine. The Dutch DPA’s action follows a broader European trend of holding technology companies accountable for algorithmic systems that affect workers and consumers.
discussion