Dutch regulator fines Uber 824.9 million euros for automated driver deactivations

The Dutch Data Protection Authority determined that Uber’s system deactivated driver accounts through fully automated decisions, without any human review. This practice occurred between 2018 and 2022 and affected hundreds of drivers in France. The regulator concluded that such automated actions violate GDPR provisions on profiling and automated decision-making. Consequently, Uber was ordered to pay 824.9 million euros.

For engineers, the ruling means that any algorithm that can terminate a worker’s access to income must include a manual override or human-in-the-loop check. Implementing such safeguards may require redesigning decision-logic, adding audit logs, and creating appeal channels for affected users. These changes increase development effort and operational overhead, especially for platforms that rely on real-time matching. The potential fine of up to 4% of global turnover makes the cost of non-compliance far higher than the engineering investment.

The fine is calculated as the maximum penalty under GDPR, derived from four percent of Uber’s worldwide annual turnover, showing regulators are willing to apply the top tier of the rule. Uber’s previous fines were far lower, indicating a stepwise escalation for repeated violations. The company has already lodged an appeal, which could reduce or delay the final payment. Until the appeal is resolved, the financial uncertainty remains a risk for investors and operators.

Outside the EU, the decision does not directly affect operations, but multinational firms may adopt similar standards to avoid divergent practices. Engineers working on global platforms should treat the EU ruling as a benchmark for acceptable automation limits. Systems that cannot guarantee human oversight for high-impact outcomes may need to be geo-fenced or redesigned. The case underscores that regulatory scrutiny of AI-driven labor decisions is intensifying.