AP (The Netherlands) - Uber B.V and Uber Technologies Inc.
Dutch DPA fines Uber €825M for automated driver deactivations violating GDPR.
The Dutch Data Protection Authority (AP) has fined Uber B.V. and Uber Technologies Inc. €824.99 million for violating GDPR Article 22. The company used automated systems to deactivate drivers' accounts based on behavior and ratings without human intervention, and failed to provide sufficient transparency about this process. The violations occurred between 2018 and 2022, and Uber has since ceased these practices.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Uber?
Get an email when a new story names Uber, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonUber violated GDPR Article 22 by using fully automated systems to deactivate drivers' accounts based on behavioral data and ratings without meaningful human oversight or intervention. This is a critical reminder that automated decision-making systems that significantly affect individuals must comply with strict transparency and human-review requirements under EU data protection law. The four-year violation window (2018–2022) highlights how unchecked algorithmic processes can persist and accumulate regulatory risk. Organizations must treat automated decision-making as a high-risk data processing activity subject to Data Protection Impact Assessments (DPIAs) and ongoing compliance monitoring.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.