Image: Nadya So / Shutterstock.com
A computer makes a decision. A driver suddenly loses access to the platform. And in the end, there’s a bill for nearly 825 million euros.
What sounds like a science-fiction scenario is now a reality. The Dutch data protection authority has imposed one of the highest fines ever levied under European data protection rules on Uber.
The allegation: Uber is said to have had driver accounts suspended—in some cases automatically—between 2018 and 2022. An algorithm analyzed, among other things, driver behavior and customer ratings. If fraud was suspected or if ratings were poor, the system could trigger a suspension.
The problem, from the authorities' perspective: When a machine makes a decision that has significant consequences for a person, that person must not simply be excluded from the process.
And this is exactly where it becomes interesting for companies of all sizes.
When the Computer Suddenly Decides on the Job
Let's imagine a driver who opens his app in the morning—and suddenly can't work anymore.
No conversation with a staff member. No personal phone call. No opportunity to explain his side of the story before the suspension.
Instead, a system made a decision based on certain data: This account will be suspended.
This can have dramatic consequences for a driver. After all, anyone who works through a platform like Uber relies on access to it. If the account is blocked, the driver cannot accept rides. This can result in an immediate loss of income.
That is precisely why European data protection rules take a particularly critical view of such automated decisions.
The point is not that companies are not allowed to use algorithms at all. Of course, computers can analyze large amounts of data and help companies make decisions.
The crucial question is rather this: Should the computer ultimately be allowed to press the decisive button all by itself?
What Uber Is Accused Of
According to the findings of the Dutch data protection authority, drivers were automatically suspended on a temporary basis in cases where, among other things, fraud was suspected.
This could include, for example, unusual trips or certain patterns of behavior.
Customer reviews also played a role. According to the agency's findings, accounts could even be permanently deactivated if they consistently received poor reviews.
At first glance, that sounds like a reasonable protective measure. After all, a platform must take action against fraud and protect its customers.
But this is precisely where the difficulty lies: An algorithm can recognize patterns. However, it cannot automatically understand why a particular event occurred.
For example, a driver may have taken an unusual route because a road was closed. A poor rating may be based on a misunderstanding. Unusual behavior may have a completely harmless reason.
At first, a computer sees only data.
A person can ask questions.
825 million euros: A fine that sends a strong message
The total is enormous: 824.99 million euros.
This makes the fine one of the largest ever imposed under European data protection rules. Only the fine of billions imposed on Meta in 2023 exceeds this amount.
The Dutch authority attributes the enormous amount, among other things, to the duration and severity of the violations. The decisions in question could have had a significant impact on the professional situation of the drivers involved.
The agency also found that drivers had not been adequately informed that such automated decisions were being made.
That is a crucial point.
After all, people shouldn't find out that a machine is deciding their professional future only when access is suddenly blocked.
The case began with 171 French drivers
Behind that enormous sum lies a story that began on a much smaller scale.
The focus is on complaints from French Uber drivers. More than 170 drivers reached out to the French human rights organization Ligue des droits de l’Homme to discuss their issues.
The French data protection authority, the CNIL, accepted the complaints. Because Uber's European headquarters is located in the Netherlands, the proceedings were subsequently handled by the Dutch data protection authority.
That's an interesting detail: A dispute that began with drivers in France ultimately led to a decision by the Dutch authorities with Europe-wide implications.
The French agency collaborated with its Dutch counterparts on this matter.
This case thus also illustrates how European data protection oversight works today: Large companies cannot simply assume that a problem will remain confined to one country just because their business operates in many countries.
Uber disagrees: “Disproportionate!”
Uber does not accept the decision. The company announced that it would challenge the fine and described the amount as disproportionate.
Uber also emphasizes that the practices in question date back to the past and have since been changed. According to the company, there are now human reviews and opportunities for drivers to appeal suspensions.
Uber also denies that permanent account suspensions were carried out entirely automatically.
This is important: Although the penalty has been imposed, that does not necessarily mean the dispute is over.
Uber can challenge the decision in court. Whether the fine will ultimately be upheld at this amount is therefore another question.
The algorithm isn't the villain—but it needs boundaries
This case raises a much bigger question. Algorithms are everywhere. Banks use them to evaluate customers. Insurance companies analyze data. Companies filter job applications. Platforms rate users. Online retailers detect attempts at fraud. This can be useful. After all, no one wants a company to have to manually review every single transaction.
The problem arises when an automated analysis leads to a decision that significantly changes a person’s life—and no one can explain why that decision was made. That is exactly why transparent processes are so important.
A company should know what data is used to make a decision. It should be clear why a system raises a particular suspicion. And, above all, a person should be able to intervene if a decision has significant consequences for the individual concerned.
What Companies Should Learn From This
The Uber case is of interest not only to international platform companies.
Even smaller companies are now turning to automated systems.
Software sorts job applications. Programs detect suspicious transactions. Customers are automatically rated. Insurance applications are reviewed digitally. Employees are evaluated based on key performance indicators.
The more such systems interfere with people's lives, the more important the question becomes: What happens if the computer is wrong?
Companies should therefore critically review their automated processes.
Are people informed about such procedures?
Can a person affected by a decision understand why that decision was made?
Can a person review the decision?
Is there a way to correct errors?
And above all: Did a human being really make the final decision—or did an employee simply rubber-stamp an automated result?
The difference can be crucial.
Uber had already run into trouble with data protection before
This latest penalty didn't come out of the blue for Uber.
The Dutch data protection authority had already targeted the company on several occasions.
In 2023, a fine of 10 million euros was imposed. In 2024, another fine of 290 million euros was imposed in connection with the transfer of European drivers' personal data to the United States.
The nearly 825 million euros that have now been imposed represent an entirely different order of magnitude.
This shows just how seriously European data protection authorities are now taking action against major platforms.
Data protection is no longer just a tedious side issue that companies can brush aside somewhere in the fine print.
For multinational corporations, data protection can now pose a financial risk amounting to billions.
An algorithm must not act as a judge without a court of appeals
Companies love algorithms because they are fast, inexpensive, and scalable. People, on the other hand, are slow, expensive, and prone to making mistakes.
The problem: That is exactly why we need people in positions where decisions affecting others carry particularly heavy weight.
A computer can determine that 37 data points point to a driver being at fault. However, it cannot automatically understand that there might be a completely harmless explanation behind the 38th data point.
Anyone who gives an algorithm the power to take people's jobs should also have a person on hand who can stop the algorithm if necessary.
After all, technology is meant to support people—not turn them into numbers.
The 825-million-euro fine imposed on Uber is therefore more than just a hefty bill for a single company. It serves as a warning to all companies that are increasingly automating their decision-making processes.
The message from Europe is quite clear: It's okay to let a machine do the calculations. But if, in the end, a person ends up paying the price, we should be able to explain why.
Avoid penalties that could threaten your business’s survival due to faulty algorithms. Seek legal advice and protect your business!
to the lawyerAt a fixed price of 169 EURO (gross)
