Uber Hit With €825 Million Dutch GDPR Fine Over Automated Driver Suspensions

Uber faces an €825 million fine from the Dutch Data Protection Authority for deactivating driver accounts through automated systems without adequately informing affected workers. The decision, dated August 17, ranks as the second-largest penalty issued under the European Union’s General Data Protection Regulation, behind Meta’s €1.2 billion sanction.

The fine converts to roughly $963 million to $966 million, depending on the exchange rate used by the publisher. Coverage consistently identifies the case as a privacy enforcement action centered on automated account suspensions, rather than a newly disclosed criminal intrusion into Uber’s systems.

The Dutch regulator said Uber used software to suspend or permanently deactivate some driver accounts without a human review designed to catch errors. Drivers were also not given adequate information about how the decisions were made or how they could challenge them, according to accounts of the decision.

That process matters because account deactivation can remove a driver’s access to income immediately. The case places automated decision-making, explainability and appeal rights at the center of platform work, where companies use data and software to assess identity, safety, location, payment activity and alleged policy violations. Quartz described the contested practice as software acting alone to deactivate accounts, while the Associated Press emphasized the absence of human checks in some cases.

Uber said it will appeal the decision and called the fine disproportionate. The appeal will give the company an opportunity to challenge the regulator’s interpretation of its systems, the scale of the penalty and the remedies attached to the ruling.

The dispute also reflects a wider conflict between platform operators and European regulators over algorithmic management. Uber has faced repeated scrutiny in the Netherlands, including a separate €290 million penalty announced in 2024 for transferring European drivers’ personal data to servers in the United States. That earlier case involved international data transfers, while the new action concerns automated suspensions and information provided to drivers.

The case raises the cost of treating automated enforcement as an internal operational tool. GDPR rules restrict certain solely automated decisions that produce significant effects and require organizations to provide meaningful information, safeguards and avenues for human intervention in covered situations.

For ride-hailing, delivery and online labor companies, compliance now reaches beyond data storage and breach response. Firms must document how automated decisions are produced, identify when those decisions materially affect a person, explain the relevant logic in accessible terms and maintain a practical route for review. The size of Uber’s proposed penalty gives regulators a prominent example of the financial exposure attached to failures in those controls.

Uber’s appeal will determine whether the €825 million penalty stands, is reduced or is overturned. The case will also test how European authorities apply GDPR protections to algorithmic decisions that govern access to work, rather than traditional consumer services alone.

The ruling arrives as European regulators continue imposing large penalties on US technology companies over privacy, competition and digital-market practices. For drivers, the immediate issue is whether account decisions receive understandable explanations and meaningful human review. For companies, the next stage is legal and operational: defend existing systems, redesign suspension workflows and preserve evidence showing that automated decisions comply with European data rules.