Uber fined €825m for ADM-related GDPR violations

In a decision on 17 August, the Dutch data protection authority, Autoriteit Persoonsgegevens (AP), fined ride-hailing company Uber €825 million for using automated systems to deactivate driver accounts without adequately informing them, a violation of the EU General Data Protection Regulation (GDPR). An investigation covering European incidents between 2018 and 2022, stemming from a French complaint, fell under the Dutch DPA's jurisdiction because Uber maintains its European headquarters in Amsterdam.

According to the AP, Uber breached the rights of its drivers by subjecting them to automated decision-making that carried legal or significant consequences and by failing to fully inform individuals about the processes. The regulator noted that drivers with low ratings faced permanent automated deactivation, alongside temporary suspensions for suspected fraud, such as inflating fares through detours.

Uber said it will appeal against the decision, describing the fine as disproportionate and noting it evaluated historic policies discontinued years ago. The company disputed the findings, maintaining that permanent deactivations are never automated, that human reviews and appeals safeguards are standard practice, and that only 126 European drivers were deactivated due to low ratings in 2021.

(Translate to English: Google Chrome, Mozilla Firefox, Microsoft Edge, or Apple Safari) 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.