Uber Faces €825 Million GDPR Fine Over Automated Driver Suspensions
Uber faces an €825 million Dutch GDPR fine over automated driver suspensions, the second largest penalty under the law, and plans to appeal the decision.
Summary
The Dutch Data Protection Authority imposed an €825 million fine, about $966 million, on Uber, the second largest GDPR penalty issued so far. It found that automated systems deactivated drivers without sufficient warning or human oversight. Deputy chair Monique Verdier called the conduct a serious infringement and said computers should not independently make consequential decisions. Uber says most suspensions are brief, permanent deactivations receive human review and drivers can appeal. It disputes the regulator’s finding that some permanent removals lacked human review and will appeal what it calls a disproportionate fine.
Former French Uber driver Brahim Ben Ali gathered testimony from 170 drivers after his account was deactivated in 2019, then complained in the Netherlands, where Uber has its European headquarters. Swiss digital rights nonprofit PersonalData.io helped drivers obtain data about the decisions. Founder Paul-Olivier Dehaye said one serious report can outweigh 1,000 successful journeys. The same driver group prompted earlier Uber fines of €290 million over personal data handling and €10 million over related issues. Dehaye plans a compensation class action through his new company, StartClaims, which could later pursue other gig economy and adtech cases.
John Gruber warned the decision could hinder Uber’s monitoring of scams or drivers who strand riders, arguing that managers set policies while devices measure compliance. Dehaye said Uber may punish fraud using humans but must accept employer-like responsibility for those decisions rather than presenting itself solely as a marketplace.
Positives
- €825 million penalty strengthens enforcement against automated decisions that can abruptly remove drivers’ income.
- 170 drivers contributed testimony after Brahim Ben Ali began documenting deactivations following his own removal in 2019.
- PersonalData.io helped affected drivers obtain information about how Uber reached deactivation decisions.
- Uber says drivers can appeal suspensions and that permanent deactivations receive human review.
- StartClaims plans a class action through which drivers could seek compensation.
Risks & concerns
- €825 million, about $966 million, is the second largest GDPR penalty issued so far.
- Dutch regulators found that automated deactivations lacked sufficient warning or human oversight.
- Some drivers were permanently removed without human review, the regulator says, although Uber disputes that finding.
- Earlier penalties of €290 million and €10 million make this the Dutch regulator’s third fine against Uber.
- A single serious report can outweigh 1,000 successful journeys and produce enormous consequences for a driver, Paul-Olivier Dehaye said.
- John Gruber warned the ruling could complicate Uber’s efforts to detect scams or prevent riders from being stranded.