Uber has been hit with a massive fine by Dutch data protection regulators—nearly $1 billion—over the way it handled certain driver account suspensions. The authority says Uber relied on automated software to make decisions affecting drivers’ ability to earn, at times resulting in permanent suspensions, and did so without the level of human review required under EU privacy rules.
According to the regulator, the violations occurred over several years, from 2018 to 2022. The case highlights an important shift in how companies may use automated systems when outcomes can significantly impact individuals’ rights and opportunities.
Dutch regulator: automated decisions without human review
The Dutch Data Protection Authority (DPA) said it found that Uber used automated tools to suspend driver accounts. In some cases, those suspensions could be permanent. The key concern was that the process lacked meaningful human verification to catch mistakes before account access was removed.
Under the EU’s General Data Protection Regulation (GDPR), fully automated decision-making that produces legal or similarly significant effects on individuals is heavily restricted. The DPA’s position is that Uber’s approach crossed that line.
Nearly €825 million penalty under the GDPR
In a decision issued on Friday, the regulator imposed a fine of 825 million euros, which the DPA also described as roughly $964 million. The authority linked the penalty to violations of the GDPR.
The regulator’s reasoning centers on the GDPR’s limits around automated decisions. When automation is used to take actions with major consequences—such as suspending someone’s account and blocking their ability to work—there must be safeguards that ensure errors can be identified and corrected.
Drivers were allegedly not properly informed
Beyond the automation itself, the DPA also stated that Uber failed to adequately inform drivers about its automatic decision-making process. In other words, the regulator says drivers were not given sufficient clarity regarding how those decisions were made and when automation played a role.
This is particularly consequential because transparency helps individuals understand what happened and what options they have if they disagree with an outcome.
Timeline: violations reportedly occurred from 2018 to 2022
The authority said the relevant conduct took place between 2018 and 2022. That multi-year window matters, because it suggests the automated driver suspension process was not limited to a short pilot program.
The DPA also noted that it examined “historic policies” that had been discontinued years earlier. Even so, the regulator proceeded with findings tied to those earlier practices.
Uber disputes the decision and plans to appeal
Uber responded by disagreeing with the regulator’s decision and the fine. The company said it would file an appeal.
In its written statement, Uber said the DPA reviewed past policies that were discontinued. The company emphasized that decisions affecting drivers are taken seriously and that it is committed to fair treatment.
Uber also argued that it includes safeguards such as human reviews, robust protections, and an opportunity for drivers to appeal decisions they believe are incorrect. In the company’s view, those measures are designed to prevent errors and ensure drivers can challenge outcomes.
What this case signals for automated driver suspensions
This outcome puts renewed focus on how platforms manage automated account enforcement. Automated systems can help with speed and consistency, but when the result is the suspension of an account—especially where it may remove a person’s income without a human check—it raises legal and ethical questions.
For operators, the decision underscores that GDPR compliance is not only about having an automated system. It’s also about ensuring the process includes appropriate oversight, transparency, and avenues for contesting decisions.
Why GDPR restrictions on automation matter
EU privacy rules aim to prevent individuals from being judged solely by algorithms when those decisions carry significant consequences. That’s why the GDPR requires careful consideration for automation, particularly for decisions that can affect someone’s access to work or services.
The DPA’s findings suggest that Uber’s automated driver suspensions were treated as decisions with substantial impact. If a platform wants to rely on automation, it must also provide safeguards that align with the GDPR’s expectations for accountability.
Fourth Uber fine from the Dutch authority
This is not the first time Uber has faced a substantial penalty from the Dutch regulators. The DPA said it is the fourth fine it has imposed on Uber.
One of the earlier penalties was in 2024, when Uber was fined 290 million euros for allegations that it transferred personal details of European drivers to the United States without adequate protection.
Taken together, the fines illustrate a pattern of scrutiny by the regulator on multiple aspects of Uber’s data practices, including both cross-border handling and the governance of automated decisions.
Drivers and platforms: likely next steps
While the DPA’s decision is significant, Uber’s planned appeal means the legal process is not yet over. Still, the case may push platforms to review their account enforcement workflows, especially where automation can lead to account restrictions.
For drivers, the immediate impact depends on how the suspension policies and appeals processes function in practice. For companies, the main lesson is that automated driver suspensions must be paired with compliance-focused design choices—human oversight where required, clearer communication, and meaningful redress.
Conclusion
The nearly $1 billion fine against Uber in the Netherlands centers on automated driver suspensions carried out without the type of human review the GDPR expects, along with alleged shortcomings in informing drivers about automatic decision-making. The regulator’s findings cover a period from 2018 to 2022, and Uber says it will appeal.
Whatever the outcome of the appeal, the case is a clear reminder that automation in high-impact decisions must be governed carefully—especially when individuals’ ability to earn is on the line.
