Uber Fined 825 Million Euros Because No Human Checked the Algorithm

Software decided when an Uber driver stopped earning and nobody checked the result. The Dutch data protection authority has now put a price on that, 824,990,000 euros. It is the second largest fine ever issued under the GDPR behind only the 1.2 billion euros Ireland imposed on Meta in 2023.

The Autoriteit Persoonsgegevens published its decision on 21 August 2026. Between 2018 and 2022, Uber ran systems that tracked driving behaviour and customer ratings. When the software flagged a suspicion of fraud or a rating it judged too low, the account was deactivated automatically. Temporarily on a first flag, permanently where low ratings persisted. No person assessed the outcome at any stage. Income through the platform stopped the moment it took effect.

Monique Verdier, deputy chair of the AP, was blunt about it in the authority’s statement. “A computer should not make decisions on its own that have major consequences,” she said. Uber has since dropped the practice according to the AP.

The Case Was Built in Paris

The investigation did not begin in the Netherlands. According to the AP, 171 French drivers took their situation to the human rights organisation Ligue des droits de l’Homme which lodged a complaint with the French regulator CNIL on their behalf. Because Uber’s European headquarters sit in Amsterdam, the one-stop shop mechanism handed the file to the AP as lead supervisory authority. The same complaint pathway produced the two earlier Dutch decisions against the company, 10 million euros in 2023 over retention terms and obstructed access requests and 290 million euros in 2024 over driver data sent to the United States.

Four AP penalties now sit against Uber. They run 600,000 euros in 2018, 10 million in 2023, 290 million in 2024 and 824,990,000 in 2026. The nominal total is 1,125,590,000 euros.

Where the Number Comes From

GDPR fines are capped at 4 per cent of worldwide annual turnover. The AP put Uber’s 2025 global turnover at roughly 44.5 billion euros which sets the ceiling near 1.78 billion. The penalty lands at about 1.85 per cent of turnover, a little under half of what the regulator could have imposed.

For scale, every data protection authority across the European Economic Area issued a combined 1,145,760,374 euros in GDPR fines during the whole of 2025, according to the European Data Protection Board’s annual report published on 9 April 2026. This single decision is worth roughly 72 per cent of that year’s total across 30 countries. The Dutch authority accounted for 353.4 million euros of it across 42 enforcement actions. The AP fines rarely and it fines heavily. That is a chosen posture, not an accident of caseload.

The second finding attracts less attention and is easier to fall foul of. The AP held that Uber did not adequately inform drivers that automated decision-making was running at all. A deactivation notice is not an explanation. Articles 13 and 14 ask for the logic driving the processing and for what that processing will do to the person on the receiving end.

Announced Is Not Collected

Uber is appealing. The company calls the amount disproportionate and points to its present rules which route a permanent deactivation through a person and give drivers a way to contest one. It told the Associated Press that the regulator had examined “historic policies that were discontinued years ago”. Uber is also still fighting the 2023 and 2024 Dutch penalties which leaves three of the four decisions against it open at once.

That matters more than the headline figure suggests. An analysis published in May 2026 put nearly 40 per cent of the 7.1 billion euros announced in GDPR penalties in one of two buckets, struck down or still being fought. A tribunal in Rome killed a 15 million euro penalty against OpenAI on jurisdictional grounds. Amazon’s 746 million euro fine went back to the regulator after a Luxembourg court intervened. Treat 824,990,000 euros as an opening position rather than a transfer of funds.

The legal ground is moving underneath the decision as well. The European Commission’s Digital Omnibus, published on 19 November 2025, would turn Article 22 from a right held by the individual into a list of conditions under which automated processing is allowed and says plainly that offering someone a human alternative does not stop a controller from deciding by machine alone. Had that text been law between 2018 and 2022, the AP would have been arguing a different case.

Sweden Has Until 2 December

The EU platform work directive must be in national law by 2 December 2026 and it regulates algorithmic management directly rather than through data protection principles. The Swedish inquiry with Supreme Court justice Jonas Malmberg as special investigator, delivered SOU 2026:3 in January 2026 and proposes a new lagen om plattformsarbete.

Chapter 3 of that draft covers data protection in algorithmic management and falls under IMY supervision. Chapter 4 is the part fewer Swedish platforms have costed, a digital work platform that is an employer must negotiate with the relevant trade union before introducing or changing an automated monitoring or decision system, hand over the data protection impact assessment and evaluate in writing at least every two years how those automated decisions affect the people subject to them. Platforms with more than 250 employees pay the union’s expert costs.

Svenskt Näringsliv told the consultation in April 2026 that the algorithmic management rules are far-reaching, carry a large number of administrative duties and overlap with obligations that already exist under the GDPR and the AI Act. Its argument is against over-implementation, not against the directive. The date does not move either way and contracts signed before 2 December 2026 that are still running on the day are covered.

The Test Applies Well Beyond Ride-Hailing

Nothing in the AP’s reasoning depends on ride-hailing or on whether a system gets called AI. What matters is whether the output lands a real consequence on an identifiable person. Credit refusals, fraud blocks, automated account suspension, eligibility screening and revoked access all sit inside that frame. Austria’s regulator reached the same conclusion about automated credit scoring indicators in September 2025 and in November a German administrative court told Schufa to show how it arrives at an individual score.

The AP’s draft guidance on meaningful human intervention, opened for consultation in March 2025, gives a test worth running internally this week. The person reviewing an automated outcome needs the standing to reverse it and needs to reverse it when the file warrants that. A reviewer who has never once said no is not oversight. Find out who holds that standing in your organisation, then ask them how many times they have used it.