DECISION SUMMARY
What happened
On 21 August 2026 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, the AP) announced a €824,990,000 administrative fine on Uber, the second-largest fine issued under the GDPR and by some distance the largest ever imposed for an automated decision-making breach. The AP found that, between 2018 and 2022, Uber deactivated the accounts of platform drivers through decisions taken entirely by software, with no meaningful human review, in breach of the Article 22 prohibition on solely automated decisions that significantly affect people. The AP acted as lead supervisory authority because Uber's European headquarters are in the Netherlands.
The case began with a complaint from 171 French Uber drivers to the French human-rights organisation the Ligue des droits de l'Homme (LDH), which escalated it to the French CNIL. Because Uber's main EU establishment is Dutch, the matter was handled through the one-stop-shop mechanism with the AP as lead authority and the CNIL among the concerned authorities. Uber has since stopped the practice at issue.
What the AP found
Uber ran systems that tracked driving behaviour and customer ratings. When a system flagged a suspicion of fraud, the driver's account was deactivated temporarily; where a driver's customer rating was judged persistently too low, the account was deactivated permanently. In both cases the decision was made and executed automatically, with no person weighing the individual circumstances before a driver lost access to the platform, and with it their income. Article 22(1) gives individuals the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. Cutting off a driver's ability to earn is exactly such an effect, so the deactivations fell within the prohibition unless a narrow Article 22(2) exception applied with the required safeguards. The AP found none did.
The AP separately found that Uber had not given drivers the information the GDPR requires about this automated decision-making. Articles 13 and 14 oblige a controller to tell people about the existence of automated decision-making, including profiling, and to provide meaningful information about the logic involved and the significance and envisaged consequences of the processing. Drivers were not adequately told how the deactivation decisions were reached or how to contest them.
Why the fine was this size
An Article 22 breach engages the upper tier of Article 83(5), capped at €20 million or 4% of total worldwide annual turnover, whichever is higher. Uber's 2025 group revenue was reported at roughly €44.5 billion, so the 4% ceiling sat well above €825 million: at about 1.85% of turnover, the fine reflects the AP's Article 83(2) balancing of the gravity, duration and number of people affected rather than the statutory maximum. The infringement ran for around four years and affected a large population of drivers whose livelihoods depended on continued access to the platform, both aggravating factors. The result places an Article 22 automated-decision-making case, for the first time, in the same size bracket as the largest Chapter V transfer fines, alongside Meta's €1.2 billion and Uber's own €290 million 2024 transfer penalty.
Resolution and status
Uber has stated it will appeal. Under Dutch procedure, lodging an objection and any subsequent appeal suspends enforcement of the fine while the challenge works through the courts, a process that can run for several years, so the amount is not yet payable. It stands as issued unless and until it is reduced or annulled. This is the third AP penalty Uber is contesting, after a €10 million transparency fine in 2023 and the €290 million driver-data transfer fine in 2024.
What this decision tells controllers
The Uber decision is the clearest signal yet that Article 22 has real teeth for platform and algorithmic businesses. Where an automated system takes a decision that significantly affects someone, whether it deactivates an account, denies credit, or filters a job application, a controller cannot rely on nominal human oversight: the intervention must be meaningful, by someone with the authority and information to change the outcome. Controllers must also be able to point to a lawful Article 22(2) basis and disclose the automated decision-making up front under Articles 13 and 14, with meaningful information about the logic and consequences. The size of the fine shows regulators will treat the number of people affected and the severity of the consequences, here, people's income, as direct drivers of the penalty.