Privacy & Cybersecurity Law Blog

On August 21, 2026, the Dutch Data Protection Authority (the “Dutch DPA”) announced that it had fined Uber €824,990,000 for infringing the EU General Data Protection Regulation’s (“GDPR”) prohibition on certain solely automated decisions with respect to drivers. According to the Dutch DPA, Uber used software between 2018 and 2022 to monitor drivers’ behavior and customer ratings, and automatically deactivate driver accounts where fraud was suspected or ratings were considered too low. The Dutch DPA concluded that these decisions were made without meaningful human involvement, even though they could have significant consequences for drivers, including loss of income.

The Dutch DPA concluded that Uber violated the GDPR’s restrictions on solely automated decision-making producing legal effects or similarly significant effects. In the Dutch DPA’s view, temporarily or permanently deactivating a driver’s account based exclusively on automated processing fell within that prohibition. The Dutch DPA also found that Uber did not provide drivers with sufficient information about the use of automated decision-making in these circumstances. According to the Dutch DPA, Uber has since changed its practices.

The matter arose from complaints submitted by 171 drivers in France and was handled by the Dutch DPA as Uber’s lead supervisory authority under the GDPR’s one-stop-shop mechanism. The Dutch DPA said it worked closely with the French data protection authority, and aligned its regulatory action with other European data protection authorities. Uber has appealed the decision and stated that it strongly disagrees with both the findings and the amount of the fine.

Read the Dutch DPA’s announcement in English.