Autoriteit Persoonsgegevens Fine Against Uber (Automated Driver Blocking)

This is a regulatory enforcement action brought by the Dutch data protection authority (AP) against Uber for using fully automated algorithms to manage and terminate gig economy workers. The regulator scrutinizes the legality of deploying automated decision-making software without human intervention in the transportation sector.

Who is the plaintiff?

The Autoriteit Persoonsgegevens (AP) is the national privacy regulator of the Netherlands, responsible for overseeing compliance with data protection laws. The AP acted as the lead supervisory authority under the GDPR's one-stop-shop mechanism because Uber's European headquarters are based in the Netherlands. The investigation was originally triggered by a complaint submitted to the French regulator (CNIL) by the Ligue des droits de l'Homme (LDH), a human rights organization acting on behalf of 171 drivers who experienced sudden account suspensions.

What is being alleged?

The AP found that Uber violated the General Data Protection Regulation's strict prohibition on fully automated decision-making. The regulator determined that between 2018 and 2022, Uber deployed proprietary software to track driver behavior and customer reviews. When the system detected low ratings or suspected fraud, it automatically deactivated driver accounts - either temporarily or permanently - without any human assessment or oversight. Additionally, the AP determined that Uber failed to sufficiently inform its drivers about how these automatic decision-making processes functioned and how they would impact the drivers' ability to work.

Why is the defendant being sued?

Uber was subject to this enforcement action because its automated systems unilaterally made decisions that had major consequences for individuals. These algorithmic decisions instantly deprived drivers of their income without warning or an opportunity for human review. In response to these findings, the AP levied a fine of 824,990,000 euros, calculated based on the maximum penalty of 4% of the company's 2025 worldwide annual turnover, which was around 44.5 billion euros.

For Employers and HR Teams

The regulatory action highlights significant compliance risks for organizations deploying automated systems to manage, evaluate, or terminate workers. Employers may need to consider establishing meaningful human oversight and review mechanisms for any automated decisions that affect worker income or employment status. This enforcement increases the importance of transparency, demonstrating that employers must provide clear, accessible information to workers about how automated decision-making tools function and impact them.

For HR Technology Vendors

The case illustrates how providers of automated management tools may face deep scrutiny if their systems execute high-stakes employment actions without supporting human-in-the-loop interventions. Providers may need to evaluate product design to ensure deployers can easily insert human oversight before adverse actions like account suspensions are finalized. It also emphasizes the necessity for robust documentation and explainability features to help deployers meet their stringent transparency obligations under international data protection frameworks.

Provider: Uber

Products or Systems Named: Automated software for tracking driver behavior and customer reviews

Employment Use Cases: Worker management, performance evaluation, fraud detection, and account deactivation

Role in Decision-Making: The software automatically tracked customer reviews and driving behavior, executing temporary or permanent account deactivations based on its algorithmic outputs without any human assessment.

Alleged Harm: Drivers were subjected to sudden account deactivations, resulting in the immediate loss of income based entirely on unreviewed software determinations.

Data or Proxy Variables Discussed: Driving behavior data, suspicion of fraud, and customer reviews.