Uber fined $966M for automated driver suspensions without oversight

Uber is facing a €825 million fine—roughly $966 million—from the Netherlands' privacy watchdog for how it used automated systems to suspend and deactivate drivers between 2018 and 2022.

The Dutch Data Protection Authority ruled that Uber violated the European Union's General Data Protection Regulation by allowing automated systems to make significant employment decisions without adequate safeguards or human oversight. The regulator also found that Uber failed to provide drivers with sufficient information about how these automated decisions were reached, according to Reuters, which first reported the decision on August 21.

The case centers on Uber's fraud-detection systems, which flagged drivers for behaviors such as allegedly taking unnecessary detours to inflate fares or accepting trips without completing them. Drivers could be suspended based on these automated assessments.

Why it matters

This penalty underscores a critical tension in AI deployment: when automated systems control access to income or employment, technical efficiency cannot override legal requirements for transparency and meaningful human review. For companies building AI-powered decision systems—whether for hiring, credit, fraud detection, or access control—the ruling signals that regulators will scrutinize not just whether humans are "in the loop," but whether that involvement is substantive enough to satisfy data protection laws.

The complaint's origins

The case traces back to Brahim Ben Ali, a driver whose Uber account was deactivated in 2019. Ben Ali collected testimony from approximately 170 other drivers and, with assistance from Swiss digital-rights nonprofit PersonalData.io, filed the complaint with Dutch authorities.

This is Uber's third major European privacy penalty in recent years. In January 2024, the company was fined €10 million for violations involving drivers' personal data. Seven months later, it received a €290 million fine for transferring European drivers' data to the United States.

Uber's response

Uber disputes the regulator's core findings and plans to appeal. The company maintains that it never fully automated permanent deactivation decisions and that drivers have opportunities to challenge any action taken against their accounts.

According to Reuters, Uber confirmed that 126 driver accounts were deactivated due to low customer ratings but argues that most contested suspensions were temporary and involved human review. The company also called the fine "disproportionate." The Dutch regulator calculated the penalty as a percentage of Uber's projected 2025 annual revenue.

Broader implications for automated systems

The ruling arrives as automated decision-making systems expand into areas with direct consequences for individuals—employment screening, loan approvals, benefits eligibility, and fraud detection among them. The case suggests that regulators will not accept post-hoc human review as sufficient compliance when the automated system has already determined the outcome.

For organizations deploying AI in high-stakes contexts, the message is clear: human oversight must be meaningful, not procedural. For individuals affected by such systems, the case reinforces the principle that they should be able to understand and effectively challenge automated decisions that affect their livelihood.

Uber's appeal may help define where European regulators draw the line between using automation as a decision-support tool and allowing it to make consequential decisions independently.

Details of the fine and the underlying violations were first reported by Reuters.