Uber: €825 million penalty for rushing to make a decision

The Netherlands' data protection authority has imposed a record fine of €824,990,000 on ride-hailing company Uber for violating key provisions of the General Data Protection Regulation (GDPR). This penalty marks the second-largest individual fine issued under GDPR since its implementation eight years ago. The decision was made by the Dutch Authority for Personal Data (Autoriteit Persoonsgegevens, AP), which oversees compliance with data protection laws in the Netherlands and handles cases involving Uber's European headquarters. According to the AP, Uber violated Article 22 of the GDPR between 2018 and 2022 by allowing fully automated decisions to be made without human oversight. The regulation prohibits such automated decisions, particularly those with significant consequences for individuals, as they can lead to unfair outcomes. In this case, Uber’s system automatically deactivated drivers based on an analysis of their driving behavior, customer ratings, and other data collected from both drivers and users. These actions were carried out without further review, leaving drivers without income overnight. Monique Verdier, deputy head of the AP, emphasized that such decisions should have been reviewed by a person before being implemented. The fine follows a long-standing investigation into potential violations of European data protection law by Uber. A French human rights organization initially brought the case forward after 170 Uber drivers reported concerns. The complaint was forwarded to France’s data protection authority, the CNIL, which determined that the issue fell under the jurisdiction of the Netherlands due to Uber’s European headquarters. The case eventually reached the Dutch authorities, who found sufficient grounds for action. This is not the first time Uber has faced penalties from the AP. Previously, the agency had fined the company €600,000 in 2018 for failing to provide drivers with access to their personal data, and €10 million in 2023 for improperly transferring driver data to the United States without proper legal basis. Uber has challenged these earlier fines through legal means, and court decisions are still pending. Similarly, the company has already filed legal appeals against the latest record fine. If upheld, the €824.990,000 fine would place Uber among the top recipients of GDPR-related penalties. It would rank behind Meta’s €1.2 billion fine, issued by Ireland’s data protection authority in 2023, and ahead of TikTok’s €530 million penalty, also issued by the Irish regulator. The AP has confirmed that the current fine relates specifically to the rights of Uber drivers and does not involve user data misuse, which was the focus of previous investigations. The AP has stated that Uber has modified its practices in the EU following the ruling, though the exact nature of these changes remains undisclosed. The case highlights the increasing scrutiny of tech companies operating within the European Union, particularly regarding how they handle sensitive data and make decisions affecting individuals. As legal challenges continue, the outcome of this case could set important precedents for future enforcement of GDPR rules.