Uber has been penalized with a fine of €824.99 million, equivalent to approximately R$ 5 billion, by the Dutch Data Protection Authority. The reason for the penalty was the use of automated systems to suspend and deactivate drivers' accounts without providing clear details about the decisions or ensuring adequate human involvement.
This determination was based on the European Union's General Data Protection Regulation (GDPR), which prohibits individuals from being subject to decisions made solely by automated processing when those decisions generate significant consequences for the person.
This amount constitutes the second-largest fine imposed under the scope of the GDPR, trailing only the €1.2 billion (R$ 7.2 billion) penalty imposed on Meta in 2023 by Irish regulatory bodies.
The Dutch authority issued the decision on August 17th and made it public this Friday (21st). The case originated from a complaint filed in France and covers incidents that occurred in Europe between 2018 and 2022. Because Uber's European headquarters is located in Amsterdam, Netherlands, the proceedings were conducted in that country.
Monique Verdier, vice-president of the Dutch authority, commented that 'from one moment to the next, they lost any income,' emphasizing that 'a computer should not make decisions alone that have such serious consequences.'
The investigation focused on the practices employed by Uber during the period from 2018 to 2022, a time when the company used various automated systems to assess driver activities and detect potential irregularities.
Uber expressed strong disagreement with the decision, classifying the fine amount as disproportionate, and announced that it will appeal. The company alleged that the Dutch authority analyzed outdated procedures that had been discarded several years ago.
Additionally, Uber specifically contested the claim that permanent deactivations were executed automatically. The company maintained that it never made permanent deactivation decisions exclusively through automated systems.
According to Uber, temporary suspensions, usually related to fraud suspicions, were typically short and did not automatically lead to permanent account exclusion. The company also emphasized that it treats decisions impacting drivers' ability to earn income very seriously, stating that its guidelines include human review, safeguards, and an appeals option.
In communication with AFP, Uber stated that 'this implies that such decisions must be reviewed by people, accompanied by solid guarantees, and that drivers must have the possibility to appeal if they believe we made a mistake.'
The company also argued that the sanction is excessive, given that the number of drivers affected by permanent deactivations would be relatively low. Uber reported that 126 drivers in Europe were deactivated in 2021 following negative customer reviews.
The regulator, on the other hand, believes that the severity of the problem is not measured solely by the number of people affected. For the authority, automated decisions capable of depriving someone of their main source of livelihood require appropriate guarantees and human involvement. The fine was calculated as a percentage of Uber's annual revenue in 2025.
The Dutch investigation began with a complaint filed by Uber drivers in France. The digital rights advocacy group PersonalData.io assisted French workers in obtaining information about the algorithmic determinations influencing their activities, and this material contributed to the investigation conducted by the Dutch authority.
Paul-Olivier Dehaye, founder of the organization, expressed satisfaction with the decision. The entity is also organizing a class action lawsuit aimed at obtaining compensation for the affected drivers.
This is not the first incident where Uber has been sanctioned by the Dutch data protection authority. According to Reuters, this is the fourth fine imposed on the company by this body. The highest previous penalty was €290 million (about R$ 1.8 billion), applied in 2024 due to issues related to the transfer of personal data of European drivers to the United States without adequate protection.
However, this new case has a distinct characteristic: in addition to data protection, it directly addresses the use of automated decisions with an impact on workers' professional lives. GDPR rules define limits for decisions made exclusively by algorithms when these generate significant effects on an individual, requiring, in these circumstances, relevant human intervention and the possibility of contestation.