Automated Decision-Making: Uber Fined Nearly EUR 825 Million Under GDPR

The decision: EUR 824 990 000 under Articles 22 and 13 of the GDPR

An administrative fine of EUR 824 990 000 hits Uber B.V.^[1] for unlawful automated decision-making and for insufficient information on profiling. It is imposed by the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, according to the summary published by the EDPB on 8 October 2026.

The summary at a glance:

• Controller: Uber B.V.
• Authority: AP (Netherlands), competent under the GDPR's One-Stop-Shop procedure because Uber's European headquarters is in the Netherlands.
• Provisions: Article 22 (automated individual decision-making, including profiling) and Article 13 (information to be provided to the data subject) of Regulation (EU) 2016/679, applicable since 25 May 2018 throughout the Union.
• Facts: incidents that took place between 2018 and 2022.
• Origin: complaints by 171 French drivers, lodged with the CNIL through the Ligue des droits de l'Homme.
• Status: Uber has appealed the fine; there is no final court ruling.

What the Dutch authority found

The finding is narrow. Where there was a suspicion of fraud or customer ratings were too low, the driver's account was automatically deactivated for a period. Where ratings were persistently low, the deactivation became permanent.

For the entire duration of the block the driver lost the income earned through Uber.

The AP classifies these choices as fully automated decisions and places them within the prohibition in Article 22 of the GDPR. It then finds a second infringement: Uber informed drivers insufficiently about the automated process.

The EDPB summary specifies that Uber has since ceased the infringements.

From abstract principle to a case with a price tag

Article 22 prohibits, as a general rule, subjecting a person to a decision based solely on automated processing where it produces legal effects or similarly significantly affects them. The text leaves open where the threshold of significant effect lies.

This decision places a precise point on the map. For the AP, the temporary blocking of a work account with loss of income already crosses that threshold. Permanent closure crosses it on the same grounds.

Two elements of the scope weigh more than the others:

• The trigger signals. A suspicion of fraud and a ratings score are enough, for the authority, to ground a prohibited decision when the outcome is triggered automatically.
• Duration. A time-limited measure counts as much as a definitive one: the loss of income during the block is the relevant effect.

It remains the reading of a lead supervisory authority. It is under appeal. The court hearing the appeal may uphold it or overturn it.

Who answers when the system decides

The fine has an addressee: the data controller, Uber B.V. The algorithm executes; the company answers.

The case also shows the reach of the One-Stop-Shop procedure. Complaints that originated in France, gathered by an association and filed with the CNIL, were decided in the Netherlands, where the group's European headquarters is based. An organisation with its main establishment in one Member State answers there for processing that affects people in other States.

Finally, there is the timeline: facts from the 2018-2022 period, a decision made public in October 2026. The cessation of the conduct, recorded by the same summary, coexists with the full fine.

Three choices the decision brings to the boardroom

1. Inventory. Which processes suspend, block or terminate a relationship with a person through an automated outcome? The list includes temporary measures, which the AP treats as decisions in their own right.
2. Human intervention. At what point in the workflow does a person with real authority examine the case before the effect occurs? The General Counsel checks which basis under Article 22(2) supports each process and which safeguards under paragraph 3 are in place.
3. Privacy notice. Does the text given to data subjects under Article 13 describe the existence of the automated process, the logic involved and the envisaged consequences? The second infringement alleged against Uber concerns precisely this document.

The same question applies to each item: which role answers for it, by name and in writing, before the system goes into production?

Status of the decision and known dates

• GDPR, Articles 22 and 13: in force, applicable since 25 May 2018, jurisdiction European Union.
• AP fine on Uber B.V.: imposed and appealed; there is no final judgment.
• Appeal timetable: the EDPB summary is silent on dates.

Until the court rules, the AP's reading is the lead supervisory authority's position on the automatic blocking of a work account.