The Dutch Data Protection Authority has fined Uber 825 million euros, about $966 million, finding that the company deactivated drivers' accounts through automated processes without sufficient warning or human oversight. TechCrunch reports it as the second-largest penalty issued under the General Data Protection Regulation, and the third Dutch fine against the company, after earlier penalties it puts at 290 million and 10 million euros.
"A computer should not make decisions on its own that have such major consequences," said Monique Verdier, the authority's deputy chair.
Uber disputes the finding. "We strongly disagree with this decision and disproportionate fine," the company said, adding that most suspensions are brief, that permanent deactivations require human review, and that drivers can appeal. It says it will appeal, so nothing here is final and both the decision and the amount could change.
The narrow question underneath
Strip out the number and the case is about one thing: whether losing access to a platform is the kind of decision a program may make by itself.
European data protection law gives people a right not to be subject to decisions taken solely by automated processing where those decisions produce legal effects or otherwise significantly affect them, together with a right to obtain human intervention and to contest the outcome. The threshold word is "significantly." An automated decision about which advertisement to show does not meet it. An automated decision that stops someone working plausibly does.
That is why deactivation is the pressure point rather than any of the other automated systems a ride-hailing app runs. For a driver, an account is not a login. It is the sole means of getting work from that company, and switching it off has the practical effect of a dismissal, whatever the contractual relationship is called.
Note that the regulator's finding and Uber's description are not straightforwardly contradictory. Uber's position is that permanent deactivations do get human review; the finding concerns whether the process as operated provided sufficient oversight and warning. Those can both be partly true, and the appeal will be about exactly that gap.
Where the case came from
It started with one driver. Brahim Ben Ali, a French Uber driver whose account was deactivated in 2019, gathered testimonies from 171 other drivers and brought the matter to the Dutch regulator.
The Netherlands is the venue because Uber's European operations are headquartered there, which under the GDPR makes the Dutch authority the lead regulator for its European data processing. That is a structural feature worth knowing: it concentrates enforcement against large platforms in a handful of national regulators, and it is why an Irish or a Dutch decision can carry continental weight.
Why this reaches beyond one company
Every platform that manages a workforce through software makes automated decisions with real consequences: delivery apps that stop assigning orders, freelance marketplaces that restrict accounts, marketplaces and rental platforms that suspend listings. None of them is named in this decision and none is reported to be under investigation here.
But the principle the regulator has asserted does not have anything Uber-specific in it. If an automated system can cut off someone's ability to earn, a person has to be in the loop, and being in the loop after the fact may not be enough.
The economics of that are not trivial. Algorithmic management is cheap precisely because it scales without staff. Requiring human review before deactivation puts a cost on every enforcement action, which changes how aggressively platforms police their networks and how quickly they act on suspected fraud. Companies will say that slows the removal of bad actors, and that argument is not empty.
What happens next
The appeal is the story now. A fine of this size against a decision-making process rather than a data breach is unusual, and how it survives review will shape what other regulators attempt.
Until then the number is a headline and not a payment. It is worth holding both facts at once: a regulator has found that the process was inadequate, and a court has not yet agreed.
