Dutch DPA fines Uber EUR 824,990,000 for unlawful automated decision-making and insufficient information on profiling
Original title: Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-making and insufficient information on profiling
The Dutch data protection authority (Autoriteit Persoonsgegevens) has imposed an administrative fine of EUR 824,990,000 on Uber for violating GDPR Article 22 by making fully automated decisions to temporarily or permanently deactivate driver accounts based on fraud suspicions or low customer ratings, and for failing to provide sufficient information about these automated decisions as required under GDPR Article 13. The case, originating from complaints by 171 French drivers, was handled under the GDPR One-Stop-Shop procedure and covered incidents between 2018 and 2022. Uber has since stopped these violations.
What changed
- Uber engaged in unlawful fully automated decision-making under GDPR Article 22 by automatically deactivating driver accounts temporarily or permanently based on fraud suspicions or low customer ratings, without human review or intervention, causing drivers to lose income during deactivation periods
- Uber failed to provide drivers with sufficient information about the automated decision-making processes, profiling, and the consequences of these decisions as required under GDPR Article 13
- An administrative fine of EUR 824,990,000 was imposed for these violations, one of the largest GDPR-related fines issued by a European data protection authority
Who is affected
Platform workers and gig economy drivers operating through Uber in the EU, particularly those subject to automated account deactivation mechanisms; EU data protection authorities enforcing GDPR automated decision-making requirements; platform-based service providers
Summary generated by a language model; the official text prevails. Not legal advice.