Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Dutch Regulator Fines Uber EUR 824.99 million for Automated Driver Deactivation Violations

Fine: EUR 824.99 million

The Autoriteit Persoonsgegevens (AP) on 21 August 2026 imposed a fine of EUR 824.99 million on Uber for fully automated decision making affecting drivers. This decision resulted from Uber's practice of automatically deactivating driver accounts based on suspected fraud or low customer ratings. The AP found that these actions violated the General Data Protection Regulation (AVG) by lacking human review.

The AP determined that Uber's software monitored driver behaviour and customer ratings, leading to automatic account deactivations when fraud was suspected or ratings were too low. This process, which occurred between 2018 and 2022, meant drivers lost income without any human assessment of their situation. The AP also concluded that Uber failed to sufficiently inform drivers about these automatic decision processes, which it has since ceased. The investigation began after 171 French drivers contacted the Ligue des droits de l’Homme (LDH), prompting a complaint to the French privacy regulator. The AP conducted the investigation due to Uber's European headquarters being in the Netherlands, utilising the one stop shop mechanism of the AVG, and coordinated its decision with other European supervisory authorities. Uber had a worldwide turnover of approximately EUR 44.5 billion in 2025, and the fine amount aligns with the standard methodology allowing fines up to 4% of a company's worldwide annual turnover.

The recurring challenge of automated decision making impacting individuals' livelihoods, particularly without human intervention, continues to draw regulatory scrutiny, as evidenced by the AP's EUR 824.99 million fine.

Original title: Uber krijgt boete van bijna 825 miljoen euro voor geautomatiseerd blokkeren van chauffeurs | Autoriteit Persoonsgegevens Overslaan en naar de inhoud gaan Menu Sluit menu Hoofdnavigatie Home Thema’s Actueel Documenten Contact FG's Actieknoppen Datalek melden Klacht indienen Topnavigatie Over de Autoriteit Persoonsgegevens EDPB Werken bij Pers Woordenboek Nederlands English Filter zoek resultaten Zoeken binnen website Zoeken Kruimelpad Home Actueel Uber krijgt boete van bijna 825 miljoen euro voor geautomatiseerd blokkeren van chauffeurs

General Data Protection Regulation (AVG)

Who this binds
Organisations processing personal data through fully automated decision making that significantly affects individuals must ensure human review and adequate information provision.
What changed
The Autoriteit Persoonsgegevens confirmed that fully automated decisions leading to income loss for individuals, without human review, violate the General Data Protection Regulation (AVG).
What to watch
Organisations should monitor the outcome of Uber's announced objection to the fine, which may provide further clarity on enforcement of automated decision making rules.
What this does not mean
This decision does not mean that all automated processing of personal data is prohibited, but specifically targets fully automated decisions with significant adverse effects on individuals without human oversight.

Not settled: Uber has announced its intention to object to the fine, meaning the final amount or the underlying decision may still change.

Send this to your team

The Autoriteit Persoonsgegevens fined Uber EUR 824.99 million on 21 August 2026 for fully automated driver account deactivations, underscoring that organisations must ensure human review for automated decisions significantly affecting individuals.

Today's question

A ride sharing company operating in the EU uses an algorithm to automatically deactivate driver accounts based on a combination of low customer ratings and suspected fraudulent activity. The deactivation leads to an immediate suspension of the driver's ability to earn income through the platform. Under GDPR, which of the following is the most critical compliance challenge for this practice?

  1. Ensuring the algorithm is trained on a sufficiently large and diverse dataset to avoid bias.
  2. Providing a human review of the automated decision and adequately informing the driver about the decision making process.
  3. Obtaining explicit consent from drivers for the processing of their performance data.
  4. Implementing robust encryption for all driver performance data stored on the platform's servers.

Answer this question on the site

Worth knowing

  1. TikTok to Pay USD 400 Million to Settle Child Privacy Lawsuit with DOJ

    Companies operating online platforms must ensure robust age verification and child privacy protections to avoid significant fines and legal action from regulators like the DOJ.

  2. ICO Releases Video Guidance for Care-Experienced Individuals on Accessing Personal Records

    Organisations handling personal data, especially in sensitive sectors like social care, should review their SAR processes and ensure they are accessible and clearly communicated to data subjects.

  3. New York Attorney General Issues Guidance on Hospital Financial Aid Access

    New York based healthcare providers must ensure their financial aid application processes protect sensitive patient financial and health data, as the Attorney General's guidance highlights potential areas for privacy risk.

  4. FTC and Connecticut Reach USD 4 Million Settlement with Manchester City Nissan Over Deceptive Fees

    Businesses engaged in sales and consumer transactions must ensure transparent pricing and avoid deceptive practices, as consumer protection agencies like the FTC actively pursue violations that can impact consumer data and trust.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.