Uber has been fined €825 million (around $966 million) by the Dutch Data Protection Authority, making it the second largest penalty issued under Europe’s General Data Protection Regulation (GDPR). The Dutch regulator investigated complaints that Uber deactivated driver accounts using an automated process, reportedly without adequate warning or human oversight.
Monique Verdier, deputy chair of the Dutch regulator, stated that Uber had “committed serious infringements,” adding that “a computer should not make decisions on its own that have [such] major consequences.”
Uber disputes the decision, arguing that most driver suspensions are brief and that permanent deactivations undergo human review, with drivers having the ability to appeal. The company has announced its intention to appeal the fine, with an Uber spokesperson telling Reuters, “We strongly disagree with this decision and disproportionate fine.”
Brahim Ben Ali, a former Uber driver, brought a complaint to the Netherlands, where Uber’s European headquarters are located, after his account was deactivated in 2019. He was assisted by the Swiss nonprofit PersonalData.io, which helped collect data on deactivation decisions.
Paul-Olivier Dehaye, founder of PersonalData.io, noted that this is the third fine the Dutch regulator has imposed on Uber, following a €290 million fine concerning driver personal data and a €10 million fine for related issues. Dehaye also plans to initiate a class action lawsuit to seek compensation for drivers.