Uber B.V. – €824,990,000 Fine (Netherlands, 2026)

Uber B.V. and Uber Technologies Inc., the controllers, used software between 2018 and 2022 to monitor drivers’ behaviour and customer ratings. Where the system detected suspected fraud or low customer ratings, drivers’ accounts could be automatically temporarily or permanently deactivated without human assessment. During the deactivation, affected drivers could no longer generate income through Uber. The proceedings followed complaints by 171 French drivers represented by the Ligue des droits de l’Homme. Since the controllers’ main European establishment was in the Netherlands, the Dutch DPA investigated the matter as lead supervisory authority in cooperation with the French DPA and other concerned authorities. The DPA held that the controllers violated Article 22 GDPR by subjecting drivers to decisions based solely on automated processing which significantly affected them. The account deactivations were made automatically, without meaningful human involvement, and prevented affected drivers from working through Uber and earning income via the platform. The DPA also found that the controllers had not sufficiently informed drivers about the automated decision-making. The press release does not specify the exact GDPR transparency provision infringed. The DPA imposed a fine of €824,99 m. The infringing practices had already ended by the time of the decision. The controller announced that it would challenge the fine.