Uber has been penalized with a fine of 825 million euros regarding the suspension of automated drivers.

      The Dutch data protection authority has imposed a fine of €825 million, approximately $966 million, on Uber for disabling driver accounts using automated systems without proper notification to the drivers. This marks the second-largest penalty issued under the General Data Protection Regulation (GDPR). Reuters reported on the decision after examining a document dated August 17. The regulator, known as the AP, confirmed the ruling but did not provide further comments. Uber announced that it plans to appeal the decision.

      Details of the ruling

      The GDPR prohibits decisions made solely by algorithms when they have significant repercussions for individuals. Such decisions must involve meaningful human participation and provide a way for the affected individual to contest them. For drivers, losing access to their accounts translates to losing their ability to work, which is the substantial impact the regulation focuses on, leading the regulator to view the suspension as more than just a change in account status. The ruling stated, "The AP has determined that Uber violated drivers’ rights, specifically the right not to be subjected to automated decision-making with significant consequences," and it further asserted that "Uber has also violated the right to be informed." The regulator deemed the matter serious enough to warrant the magnitude of the fine.

      Uber's actions

      Uber had temporarily suspended drivers’ accounts identified by its systems for suspected fraud. The reports highlighted two instances: the systems concluded that some drivers had made unnecessary detours to increase fares while flagging others for accepting rides they did not intend to complete. According to Uber, these suspensions were typically short-lived, and the company claims not to have permanently deactivated accounts without human review. However, the AP noted that Uber’s software sometimes permanently removed drivers with low customer ratings, which Uber disputed, asserting that it has never automated a permanent deactivation process.

      Uber's statement

      A spokesperson for Uber expressed strong disagreement with this ruling and the associated fine, labeling it as disproportionate. The company emphasized its commitment to drivers’ rights and stated that its current practices involve human oversight and provide a mechanism for drivers to contest suspensions. Uber mentioned to DutchNews that it no longer uses automated systems solely for permanent account deactivation. To support its claim regarding the fine's disproportionality, Uber cited that low customer ratings resulted in the loss of accounts for 126 drivers across Europe in 2021. The AP has not disclosed the total number of drivers affected by the automated suspensions.

      Origin of the case

      This ruling pertains to events that occurred in Europe from 2020 to 2022, initiated by a complaint from drivers in France who were suspended due to alleged fraud. The Dutch regulator took on the case since Uber’s European headquarters are located in Amsterdam, making the AP the lead authority for the company in the EU.

      The fourth penalty from the Netherlands

      The AP has penalized Uber several times, with each fine increasing in amount. The company received a €600,000 fine in 2018, followed by a €10 million fine in early 2024 concerning drivers’ privacy rights. Subsequently, a €290 million fine was imposed due to transfers of driver data to the United States, which was the previous record and is also under appeal. The €290 million citation stemmed from the same French complaints as this current ruling, with the new fine being nearly three times larger.

      Only one larger GDPR fine recorded

      Ireland's regulator fined Meta €1.2 billion in 2023 for unlawfully transferring European Facebook users' data to the United States, which Meta is contesting. Thus, both the largest GDPR fines on record have been given by regulators in small member states hosting the European headquarters of large American firms. Reuters noted that lengthy appeals often lead to reductions or nullifications of headline fines against significant technology companies. The desk has previously reported on how long such processes can take; for example, Google lost its final appeal regarding a €4.1 billion Android penalty in July, years after the initial ruling. Google also faced an €890 million fine, the first issued under the Digital Markets Act.

      The transatlantic dispute

      European regulators have levied billions in fines against American tech companies under privacy, competition, and digital market regulations, with Meta, Google, Apple, and Amazon all receiving multiple fines. Former US President Donald Trump criticized these practices, and a senior US State Department official described the fines as the "biggest single source of friction" in economic relations between the US and the EU in April.

      Automated decisions about workers

      The GDPR provision that Uber was found to have breached pertains to decisions made about individuals by software. Similar issues regarding software decision-making about employees have emerged elsewhere, such as a recent report about an AI store manager that required a reminder of its own rules after firing a worker. Additionally, Uber's drivers have faced data-related scrutiny outside of Europe. An earlier report indicated that a surveillance firm proposed turning Uber and Lyft drivers into a mobile camera network.

      Future developments

      Uber will appeal the decision, although it has not indicated when it will