Uber hit with $966 million fine over automated driver suspensions

Uber Technologies Inc. has been fined €825 million ($966 million) by the Dutch Data Protection Authority for using automated systems to suspend and deactivate drivers’ accounts without adequately informing them or providing sufficient safeguards around automated decision-making.

The penalty, which covers practices between 2020 and 2022, is the second largest fine imposed under the European Union’s General Data Protection Regulation (GDPR), according to the Dutch regulator.

Reuters reported that the decision was issued on August 17 and relates to complaints originating from France, with the Netherlands handling the case because Uber’s European headquarters is located there.

What they are saying

The Dutch regulator said it found that Uber’s temporary fraud waitlisting system and ratings based deactivations breached drivers’ rights by relying on automated processing that could have significant consequences for their ability to work.

However, Uber said it strongly disagreed with the decision and considered the fine disproportionate, adding that it would appeal.

• “We strongly disagree with this decision and the disproportionate fine,” a spokesperson said, adding that ​the company takes drivers’ rights seriously and its current policies include both human reviews and opportunities for drivers to dispute platform ​suspensions.

The company said the practices covered by the ruling had been discontinued years ago. According to an Uber spokesperson, the temporary fraud waitlisting process ended in 2021, while ratings-based deactivations were discontinued in 2022.

Get up to speed

The case indicated growing regulatory scrutiny of the use of algorithms and artificial intelligence in employment and platform-based businesses, particularly where automated systems can determine whether an individual can continue earning an income.

Under the GDPR, individuals have protections against decisions based solely on automated processing where those decisions produce legal or similarly significant effects.

The regulation also requires safeguards around human intervention and the ability of affected individuals to challenge such decisions.

The Uber penalty is second only to the €1.2 billion fine imposed on Meta Platforms by Irish regulators in 2023 over the transfer of European users’ personal data to the United States. Uber had also previously been fined €290 million by the Dutch regulator in 2024 over the transfer of European drivers’ personal data to the US.

What you should know

In Nigeria, Nigeria’s Data Protection Act 2023 expressly provides a right against decisions based solely on automated processing of personal data, including profiling, where such decisions produce legal or similarly significant effects.

• Section 37 of the Act requires data controllers to provide safeguards that allow affected individuals to obtain human intervention, express their views and contest automated decisions.
• The Nigeria Data Protection Commission has also highlighted automated decision making and profiling as important areas of regulatory concern as businesses deploy artificial intelligence and other emerging technologies.
• The Commission has specifically warned about automated decision making in areas such as employment, lending and profiling where decisions can have significant consequences for individuals.

The Nigerian regulator has also demonstrated that data protection enforcement can result in substantial financial penalties. In July 2025, the NDPC fined MultiChoice Nigeria N766.24 million for violations of the Nigeria Data Protection Act, following an investigation into alleged breaches of subscribers’ privacy rights and the unlawful cross-border transfer of Nigerians’ personal data.

The Commission said it also found that MultiChoice processed the personal data of individuals who were not necessarily subscribers.