Full story
GDPR fine for Uber
The Dutch Data Protection Authority imposed an 825 million euros fine on Uber for violating the GDPR after it automatically deactivated driver accounts between 2018 and 2022 without human intervention.
“automatically deactivating driver accounts between 2018 and 2022 without human intervention”
Engadget reported that the AP said Uber “automatically deactivating driver accounts between 2018 and 2022 without human intervention,” and that deputy chair Monique Verdier described the impact as “From one moment to the next, they no longer had any income through Uber.”
EU Today said the decision was made on 17 August and disclosed publicly on Friday, and it found Uber did not provide drivers with sufficient information about automated processes.
EU Today also framed the legal issue around Article 22 of the GDPR, noting that an individual has a right not to be subject to certain solely automated decisions when they produce legal or similarly significant effects.
Human review dispute
Uber said it rejects key aspects of the authority’s account and intends to appeal, arguing that permanent account deactivations were not fully automated and that meaningful human review was available.
Engadget quoted an Uber spokesperson saying, “We strongly disagree with this decision and disproportionate fine, which we will appeal.”
EU Today said the case turns on whether a decision was based solely on automated processing and whether an exception and adequate safeguards applied, including safeguards that can include human intervention and an opportunity for the person to express a view.
TechCrunch added that the Dutch regulator said some drivers were permanently deactivated without human review, while Uber disputed that characterization and said drivers have the ability to appeal.
What’s at stake next
EU Today said the litigation could matter beyond Uber because platforms increasingly use automated tools for fraud detection, safety monitoring, and account management, and a court may need to examine how cases moved through the system in practice.
“Almost every large platform automates parts of fraud detection, safety monitoring and account management.”
EU Today also emphasized that GDPR information rights require more than announcing that “automation” is used, and it described the need for meaningful information about the logic involved and the significance and envisaged consequences of the processing.
Engadget reported that the AP calculated the 824.9 million euro fine as the maximum penalty derived from four percent of a company's worldwide annual turnover, and it noted Uber has already filed an appeal against the fine.
TechCrunch said deputy chair Monique Verdier told Reuters that “A computer should not make decisions on its own that have [such] major consequences,” while Uber maintained that most driver suspensions are brief and no permanent deactivations take place without human review.