Dutch privacy watchdog fines Uber €825 million over automated driver suspensions

Uber has been fined €825 million by a Dutch privacy regulator for what the regulator described as improper use of automated decision-making tied to driver accounts. The dispute centers on how Uber suspended drivers, with the regulator alleging the company used software to deactivate accounts without meaningful human involvement.

According to the report, the enforcement action was driven by claims that Uber violated EU privacy requirements when it relied on automated systems alone to take the step of suspending drivers. In the regulator’s view, using only software to deactivate accounts did not meet the obligations that apply when personal data is used to make significant decisions about individuals.

The fine, which is framed as a GDPR (General Data Protection Regulation) related penalty, highlights how regulators are scrutinizing companies’ use of algorithms in employment-adjacent and platform governance settings. In Uber’s case, the affected individuals are drivers, whose ability to work depends on whether an account remains active.

Automated account deactivations are a sensitive area for privacy compliance because they can have immediate consequences for a person’s livelihood. The regulator’s reported criticism is notable for its focus on process, not just outcome, saying the suspensions occurred without human review.

Uber did not disclose additional details in the reported item beyond the core allegation that its software-led deactivation process lacked the kind of human consideration regulators expect under EU rules. The report also does not lay out, in the text available here, what specific safeguards Uber had in place, how often suspensions occurred, or whether drivers received a clear explanation and appeal route.

For Uber, the operational challenge is that platform rules depend heavily on automated tooling for speed and scale. Ride-hailing and delivery platforms typically use internal systems to detect fraud, safety risks, and other issues, then apply consequences ranging from warnings to account termination. Regulators increasingly expect those systems to be designed with privacy duties in mind, including transparency and the ability for affected individuals to contest certain decisions.

The broader sector context is that EU regulators have repeatedly indicated they want stronger controls around automated decision-making. Even when companies use algorithms for legitimate operational purposes, the privacy and fairness frameworks attached to GDPR place limits on how much companies can rely on automation for consequential judgments.

It is not clear from the report how Uber will respond, whether it plans to appeal, or what changes it must implement to prevent further violations. The available information also does not specify the factual basis of the specific suspensions, the exact legal provisions cited by the regulator, or the timelines and documentation Uber used in its process.