What happened
The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), has fined Uber EUR 824,990,000, about $959 million, over how it deactivated drivers. The AP ruled that Uber made fully automated decisions about drivers, blocking their accounts when they received poor customer reviews. Compliance Week, which reported the penalty on September 9, put the total at nearly $1 billion.
The AP found the practice breached the General Data Protection Regulation's prohibition on fully automated decision-making. It also found that Uber did not sufficiently inform drivers about the automatic decision-making, so drivers had little way to know that their accounts could be switched off by a machine, or how the system weighed their record.
Why this is a GRC story
Most GDPR enforcement is about how companies collect and share personal data. This case is about what a company does with a decision about a person. Article 22 of the GDPR protects people from decisions based solely on automated processing when those decisions have legal or similarly significant effects. Cutting off a driver's access to the app that provides their income is exactly that kind of decision, and the AP treated it that way.
For compliance teams the lesson is that algorithms now sit squarely inside the privacy program. Any automated system that makes or materially supports decisions about people needs the same discipline as any high-risk processing: an inventory entry, an impact assessment, documented human oversight, and a way for the person affected to question the outcome. The transparency failure matters as much as the automation itself. The AP did not just penalize the blocking, it penalized the silence around it.
The scale is the signal. Automated decision-making has produced fines before, but rarely at this level. A penalty approaching a billion dollars tells platform companies, and any employer using scoring to discipline or terminate workers, that regulators are ready to enforce Article 22, not just cite it in guidance.
What to watch
Expect Uber to fight the fine. Dutch penalties of this size are usually contested, and the AP's reasoning on what counts as a fully automated decision will be tested in court. How that appeal lands will shape how far Article 22 reaches into everyday workforce management.
Also watch whether other European data protection authorities open similar cases against platform and workforce automation. The cheap fix, adding a token human approval step with no real review, would miss the point. Documented, meaningful human oversight and clear notice to the people affected are the standard to design for now.
Attribution: Analysis based on Compliance Week and related public reporting. This article is original commentary, not a repost of the source material.