Uber is fined 825 million euros over automated driver suspensions

The Dutch data protection authority has decided to fine Uber €825mn, or about $966mn, for shutting down driver accounts by automated systems without telling the drivers properly.

It is the second-largest penalty ever issued under the General Data Protection Regulation. Reuters reported the decision after reviewing a document dated 17 August. The regulator, known as the AP, confirmed the decision and did not comment further.

Uber said it will appeal.

What the decision says

GDPR bars decisions taken by algorithm alone where they significantly affect someone. Those decisions require meaningful human involvement and a route for the person to challenge them.

For a driver, losing account access means losing the ability to work. That is the significant effect the rule is written around, and it is why the regulator treated a suspension as more than an account status change.

“The AP has determined that Uber violated drivers’ rights, specifically the right not to be subject to automated decision-making that has significant consequences,” the decision said.

It added that “Uber has also violated the right to be informed”. The regulator called the matter serious enough to warrant the size of the fine.

What Uber was doing

Uber temporarily suspended accounts of drivers its systems flagged for suspected fraud.

Two examples appear in the reporting. The systems concluded that some drivers had taken unnecessary detours to inflate fares. The software flagged others for accepting trips they did not intend to complete.

Uber said those suspensions were usually brief, and that it did not permanently deactivate accounts without human review.

The AP said Uber’s software sometimes removed drivers with low customer ratings permanently. Uber disputed that, saying it has never automated a permanent deactivation.

Uber’s response

“We strongly disagree with this decision and disproportionate fine,” a spokesperson said.

The company said it takes drivers’ rights seriously and that its current policies include human review and a way for drivers to contest suspensions. It told DutchNews that it no longer permanently deactivates accounts through automated systems alone.

Uber gave a number to support its argument that the penalty is out of proportion. It said low customer ratings cost 126 drivers their accounts across Europe in 2021.

The AP has not published a figure for how many drivers the automated suspensions touched in total.

Where the case came from

The decision covers incidents in Europe between 2020 and 2022.

It began with a complaint from drivers in France. Uber had suspended them on suspicion of fraud. The Dutch regulator took the case because Uber’s European headquarters sit in Amsterdam, which makes the AP the lead authority for Uber across the EU.

This is the fourth Dutch fine against Uber

The AP has penalised the company repeatedly, and each fine has been larger than the last.

It fined Uber €600,000 in 2018. It issued a €10mn fine in early 2024 over drivers’ privacy rights. It then imposed €290mn over transfers of driver data to the United States, which had been its record and which Uber is also appealing.

That €290mn case grew out of the same French complaints as this one. The new decision is close to three times the size of it.

Only one GDPR fine has been larger

Ireland’s regulator fined Meta €1.2bn in 2023 for unlawfully transferring European Facebook users’ data to the United States. Meta is appealing.

Both of the two largest GDPR penalties on record therefore sit with regulators in small member states that host the European headquarters of large American companies.

Reuters noted that appeals running for years often shrink or overturn headline fines against large technology companies.

The desk has covered how long that takes. Google lost its final appeal over a €4.1bn Android penalty in July, years after the original decision. Google separately took an €890mn fine, the first issued under the Digital Markets Act.

The transatlantic argument

European regulators have issued billions of euros in penalties against American technology companies under privacy, competition and digital market rules. Regulators have fined Meta, Google, Apple and Amazon more than once each.

US President Donald Trump has criticised the practice. In April, a senior US State Department official called the fines the “biggest single source of friction” in economic relations between the United States and the EU.

Automated decisions about workers

The provision Uber was found to have breached is the part of GDPR that governs decisions made about people by software.

The question of what software may decide about a worker has come up elsewhere. TNW reported this month on an AI store manager that fired an employee. It needed a reminder of its own rules first.

Uber’s drivers have also been the subject of data questions outside Europe. The desk reported in August that a surveillance company pitched turning Uber and Lyft drivers into a roaming camera network.

The Dutch regulator has been assertive on data matters more broadly. The Netherlands blocked an American company from buying the cloud provider that runs Dutch digital identity in May.

What happens next

Uber will appeal, and it has not said when it will file. Dutch appeals of this kind go first to the courts rather than back to the regulator.

The AP confirmed the decision but did not comment beyond that. Neither the regulator nor the company has published the full text.

The two sides do not agree on the facts. The AP says low-rated drivers sometimes lost their accounts to software alone. Uber says that never happened. That disagreement is what an appeal would test.

Uber also has not said whether the €825mn is provisioned in its accounts, and the AP has not set a date by which the company must pay.