Uber has been fined by the Dutch regulator for suspending or deactivating driver accounts without giving the driver the information or meaningful human involvement required. It is one of the largest fines issued under the EU’s General Data Protection Regulation (GDPR) and reflects the increasing regulatory worry about the use of algorithms in decision making, which can have significant consequences for workers.
The focus of the case is Uber’s treatment of drivers during the years of 2018 to 2022. The Dutch Data Protection Authority said the removal of drivers from the Uber platform involved automated decision making and that drivers were not always sufficiently informed about the reasons for their removal and provided adequate opportunities to challenge the decisions. People who rely on ride-hailing as a livelihood will have an impact on their finances if they lose access to the platform.
The practice of the company represented serious breaches of data protection regulations, the Dutch authority said. Uber has been found guilty of serious infringements, said the organisation’s deputy chair, Monique Verdier, in the case of Uber deactivating driver accounts without warning or human intervention. She also highlighted the broader impact of algorithms and their decisions that could significantly impact on individuals’ livelihoods. “A computer shouldn’t make decisions on its own that have (such) major consequences,” they said, “from one moment to the next they no longer had any income.”
The ruling puts Uber under a heavy burden, but does not fully satisfy the company, which has expressed the desire to appeal the ruling. Uber strongly disagreed with the decision and the penalty was disproportionate, it said. The company also said it plans to appeal the decision. Uber says its driver account policies include human review and processes for drivers to challenge suspensions.
Uber’s spat with the Dutch regulator is a symptom of a wider dispute regarding the use of automated decision making by tech firms. Major digital platforms have been using algorithms to detect fraud, analyze account usage, implement safety policies, and control the vast number of users. While companies using automation can be able to process vast amounts of information very rapidly, when the decision made by the automated system has a direct impact on a person’s employment, income or way of accessing an essential service, regulators have grown more concerned.
The GDPR sets the rules for people who are subject to some decision based on automated processing and that decision has an impact on them. The rules are intended to ensure that individuals are not denied meaningful explanations and/or a meaningful chance to challenge an automated decision. The role of the human is especially significant if a decision made by the algorithm may have severe personal or economic repercussions.
The question in Uber’s case is not so much about whether a specific driver should be allowed to continue on the platform, but whether the same should be true for the platform’s drivers. It has raised questions about how companies ought to be designing automated systems, where they actually are responsible for deciding who can work and who cannot. A platform can be built and have millions of users, and thousands of decisions to make each day, which is why it’s important to automate processes. But regulation is moving toward a requirement that efficiency can’t be sacrificed for lack of fundamental procedural protections.
The fine is said to be the biggest second penalty under the GDPR to date. It comes after a €1.2 billion fine faced by Meta by Irish regulators for selling the data of its European Facebook users to the United States in 2023. Meta has challenged that ruling, as big data fines can be capable of taking a lengthy legal path until the financial consequences are known.
The Uber case is just one in a string of initiatives by European regulators against key American tech firms. European companies such as Meta, Google, Apple and Amazon have already been hit with significant fines for infringing privacy, competition and digital market laws. These fines may come with a lot of attention when they are announced, but the total fines may be adjusted after appeals, court action or settlement.
The trend of increasingly strict regulations is also part of a broader conflict between the United States and the European Union. American tech firms have often complained that regulations exercised in Europe can be quite stringent or overly broad, whereas European regulators say large tech firms need to adhere to regulations that are meant to safeguard consumers and individuals. U.S. President Donald Trump has previously attacked Europe’s sanctions against U.S. firms, and a U.S. State Department official has called EU sanctions against U.S. firms “a significant irritant in transatlantic economic relations.
Uber’s clash is happening as automated technology has become a key component of its operations. Ride-hailing services rely on software to power their driver management, passenger relations, payment systems, safety protocols, and account histories. Automation is especially beneficial for businesses that have operations in several countries, as it might be challenging and costly for those businesses to manually review all possible violations.
