Automated decisions: UBER fined nearly EUR 825 million
24 August 2026
In cooperation with the CNIL, the Dutch Data Protection Authority fined UBER B.V. and UBER TECHNOLOGIES INC. EUR 824,990,000 for taking automated individual decisions concerning the drivers of its platform.
Uber brings together UBER B.V., a Dutch company located in Amsterdam, and UBER TECHNOLOGIES INC., a US company, with its registered office in San Francisco. In particular, Uber publishes a platform connecting PHV drivers with users.
In 2020, the CNIL received a collective complaint from the association La Ligue des droits de l’Homme, representing more than 170 drivers on the UBER platform. Supplemented in 2021, this complaint concerned, inter alia, the provision of information to individuals, transfers of personal data outside the European Union and automated decisions to temporarily and/or permanently disconnect drivers from the platform.
After imposing a first fine of EUR 10 million on 11 December 2023 for failure to inform drivers and then a second fine of EUR 290 million on 22 July 2024 for transfers of data outside the European Union, the Netherlands data protection authority ruled on the automated individual decisions.
Cooperation with the CNIL throughout the procedure
Under the procedures for cooperation between authorities established by the General Data Protection Regulation (GDPR), the Dutch data protection authority was competent to conduct investigations into this case, with UBER having its main establishment in the Netherlands.
The CNIL cooperated closely with its counterpart throughout the procedure, during the checks and analysis of the evidence obtained, and then during the examination of the draft decision under the one-stop-shop procedure.
Penalty for automatic deactivation of accounts
In particular, the Dutch Data Protection Authority considers that deactivations of drivers’ accounts in case of suspected fraud (temporary deactivation) as well as in case of low customer ratings (temporary deactivation and definitional) constitute automated individual decisions due to the complete absence of human intervention in the decision-making process. These decisions significantly affect drivers who, if their account is blocked, can no longer make rides and generate revenue.
The CNIL informed the complainants in accordance with the GDPR.
