.
Uber Technologies has been hit with an €825 million ($966 million) penalty by the Dutch Data Protection Authority (AP) over its use of automated systems to suspend and deactivate drivers without adequate transparency or safeguards.
The decision, issued on August 17, 2026, concerns practices used by Uber between 2020 and 2022 and represents the second-largest fine imposed under the European Union’s General Data Protection Regulation (GDPR).
Why the Regulator Penalised Uber
The Dutch regulator found that Uber relied on automated processing in situations where drivers could face significant consequences for their ability to work.
According to the decision, Uber’s temporary fraud waitlisting system and some ratings-based account deactivations breached drivers’ rights because the company did not provide sufficient information about the automated decision-making involved.
The regulator also determined that the safeguards surrounding those decisions were inadequate, particularly where automated systems could effectively determine whether a driver remained able to use the platform.
The case originated from complaints in France, while the Netherlands handled the investigation because Uber’s European headquarters are located there.
Uber Plans to Appeal
Uber has rejected the regulator’s findings and described the penalty as disproportionate.
The company said it plans to appeal the decision, arguing that its current systems provide opportunities for human review and allow drivers to challenge account suspensions.
Uber also maintained that the practices covered by the ruling are no longer in use. According to the company, its temporary fraud waitlisting process was discontinued in 2021, while ratings-based deactivations were phased out in 2022.
The company further argued that only a relatively small number of drivers were affected by the practices examined by the regulator.
Second-Largest GDPR Penalty
The €825 million penalty ranks behind only the €1.2 billion fine imposed on Meta in 2023, making it one of the most significant enforcement actions under Europe’s privacy regime.
The case adds to growing European scrutiny of how technology companies use algorithms to make decisions that can materially affect people’s livelihoods.
For platform companies such as Uber, automated systems can help identify suspected fraud and manage large numbers of users, but regulators are increasingly insisting that such systems cannot operate without adequate transparency and avenues for human intervention.
A Wider Issue for Algorithmic Decision-Making
The Uber case highlights a broader regulatory challenge emerging as companies increasingly deploy artificial intelligence and automated decision-making.
While algorithms can process large volumes of information quickly, decisions involving employment, access to services or other significant consequences raise questions about whether affected individuals understand why a decision was made and whether they have a meaningful opportunity to challenge it.
Under the GDPR, individuals have protections against decisions based solely on automated processing when those decisions produce legal or similarly significant effects.
Nigeria Faces a Similar Policy Question
The issue is not limited to Europe.
Nigeria’s Data Protection Act 2023 also contains protections concerning decisions based solely on automated processing where such decisions have legal or similarly significant effects.
The law provides safeguards intended to allow affected individuals to seek human intervention, express their views and contest automated decisions.
That makes the Uber case relevant to Nigerian technology companies, fintechs and digital platforms increasingly using automated systems to assess customers, workers and transactions.
The Bigger Picture
Uber’s massive penalty underscores the growing cost of deploying automated decision-making without sufficient safeguards.
For technology companies, the lesson is increasingly clear: automation may improve efficiency, but decisions that significantly affect people’s livelihoods still require transparency, accountability and appropriate human oversight.
As AI and algorithmic systems become more deeply embedded in digital platforms, regulators are likely to pay closer attention not only to what these systems can do, but also to how their decisions affect the people subjected to them.
