.webp)
According to the AP (the Dutch DPA), Uber used automated software to track drivers’ behaviour and customer reviews. Where the software identified suspected fraud or low ratings, it could automatically deactivate a driver’s account. The regulator said the consequences could be significant because a deactivated driver could no longer earn income through Uber during the period of deactivation. The AP also found that Uber did not provide drivers with sufficient information about the automated decision-making, including how driver information was used, and stated that the violations have since stopped.
What the Dutch DPA Uber Fine Covers
The AP’s decision concerns the General Data Protection Regulation (GDPR) rules on decisions based solely on automated processing. Under Article 22, individuals have the right not to be subject to a solely automated decision, including profiling, when it produces legal effects or similarly significant effects. The provision contains limited exceptions; where applicable, safeguards include the right to obtain human intervention, express a point of view and contest the decision.
For businesses and other organisations using automated tools in work allocation, access control, fraud detection, eligibility screening or customer-facing services, the case illustrates why the practical design of human review matters. A review step needs to be more than a nominal escalation route: the AP’s account of the case centres on the absence of human assessment before decisions that affected drivers’ access to income. The European Data Protection Board has also endorsed guidance on automated individual decision-making and profiling under the GDPR.
The facts reported by the AP should be read alongside the status of the case. The regulator has made its infringement findings and imposed the administrative fine, while Uber is challenging the decision through an appeal. The announcement does not resolve that appeal.
Cross-border enforcement and platform accountability
The investigation began after 171 French drivers made reports to the Ligue des droits de l’Homme, a French human rights interest group, which then brought a complaint to France’s privacy regulator, the CNIL. Because Uber’s European headquarters are in the Netherlands, the Dutch supervisory authority led the investigation under the GDPR’s one-stop-shop mechanism and says it coordinated with the French regulator and other European supervisory authorities.
The decision therefore has relevance beyond transport platforms. Automated systems can shape access to work, services or opportunities across Europe and multiple jurisdictions, while governance responsibilities may sit with a different entity within a corporate group. The related privacy and fundamental-rights questions can overlap with an organisation’s assessment processes; readers considering those intersections can explore Nemko Digital’s analysis of an integrated DPIA and FRIA framework.
What organisations should monitor
The case is a timely reminder to identify automated decisions that can materially affect individuals, document the information given to affected people, and assess whether meaningful human involvement is present in the actual workflow. Organisations should also maintain clear ownership for decision rules, review triggers, exception handling and appeals. These are operational questions that belong within a broader AI governance framework, not only within a technical model review.
Teams should further consider how a system’s outcomes may affect different groups and how concerns can be identified and corrected. Nemko Digital’s resource on fairness in AI systems provides additional context on those considerations. Looking ahead, organizations should monitor the outcome of Uber’s appeal and further enforcement activity involving high-impact automated decisions. The Dutch DPA Uber fine also underscores the connection between accountability, transparency and digital trust in systems that determine access to work or services.
