The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) has fined Uber €825 million ($966 million) for deactivating driver accounts through automated systems without adequately informing the drivers affected. The decision, issued on 17 August, marks the second-largest penalty ever handed down under Europe's General Data Protection Regulation (GDPR), surpassed only by a €1.2 billion fine imposed on Meta by Ireland's privacy regulator in 2023 for unlawfully transferring European Facebook users' data to the United States.

The case centres on incidents that took place between 2018 and 2022 and was handled by the Dutch authority because Uber's European headquarters are based in Amsterdam, the Netherlands. It originated from complaints filed in France. According to the regulator, Uber suspended accounts of drivers suspected of fraud — for example, those whose systems flagged as having taken unnecessary detours to inflate fares — without warning or meaningful human involvement. The AP also found that drivers with low customer ratings were sometimes permanently deactivated by algorithm alone, a claim Uber disputes. The company says it has never automated permanent deactivation decisions and that only 126 drivers in Europe were deactivated due to low ratings in 2021.

GDPR rules explicitly prohibit purely algorithmic decisions that have a significant impact on a person's life — such as on employment or income — without human review and a clear mechanism for challenge.