Uber hit with €825M GDPR fine over driver account deactivations

The Dutch data protection authority fined Uber €825 million, roughly ₹9,226 crore, for suspending driver accounts through automated systems without prior notice or human review, the regulator said Monday.

The Autoriteit Persoonsgegevens said the deactivations were "serious infringements" of European privacy rules. Drivers should have been told about the suspensions and given a chance to challenge them, deputy chair Monique Verdier said.

"Uber has committed serious infringements," Verdier said. "From one moment to the next they no longer had any income. A computer should not make decisions on its own that have major consequences."

Uber said it will appeal. "We strongly disagree with this decision and disproportionate fine," a spokesperson said. The company maintained that its policies already include human reviews and allow drivers to contest suspensions.

The case involves driver accounts suspended between 2018 and 2022. French authorities filed the initial complaint. The Dutch regulator took over because Uber's European headquarters are in the Netherlands.

Uber temporarily suspended drivers its systems flagged for suspected fraud, including unnecessary detours that inflated fares and trips drivers accepted but never intended to complete. Uber said those suspensions were brief and never permanent without human involvement.

The regulator found that drivers with low customer ratings were sometimes permanently deactivated automatically. Uber rejected that finding. The company said it has never used an automated system to make permanent deactivation decisions.

Uber argued the fine was excessive because only a limited number of drivers were affected. In 2021, the company said, 126 drivers across Europe were deactivated because of low customer ratings. The Dutch regulator calculated the penalty based on a share of Uber's estimated 2025 annual turnover.

The fine lands in a broader regulatory crackdown. European watchdogs have imposed billions of euros in penalties on major US technology companies in recent years. Meta, Google, Apple and Amazon have all faced fines, though some of the largest were later reduced or overturned on appeal.

President Donald Trump has criticised the EU's enforcement. In April, a State Department official described the fines as the "biggest single source of friction" in U.S.-EU economic relations. The Uber penalty could add to that tension.

Under the General Data Protection Regulation, companies cannot rely solely on algorithms for decisions with significant effects on individuals. Such decisions require meaningful human oversight and a right of challenge.

The Dutch regulator's decision tests that principle. Uber's argument that only 126 drivers were permanently deactivated due to ratings may not satisfy the standard; the regulator focused on the automated nature of even temporary suspensions. Verdier pointed to the sudden loss of income drivers experienced.

Uber said it will file an appeal. The process could take years, given the complexity of cross-border GDPR enforcement and the precedent the case could set for how platforms handle automated decisions.