A computer cut off their income. A regulator has now put a price on that.

The rule being enforced

The GDPR contains a provision that gets far less attention than the parts about cookies and consent. It restricts decisions made solely by automated processing where those decisions have legal or similarly significant effects on a person. Losing the ability to earn is the textbook example of a similarly significant effect.^1,2

The authority found two failures. The prohibition on fully automated decision-making was breached, and Uber did not sufficiently inform drivers that automated decision-making was happening at all. The second is easy to overlook and is arguably the more fixable one.¹

The principle is not that algorithms may not be used. It is that a person affected by one is entitled to a human assessment and to know the decision was automated. A company can automate the detection and still owe someone a review before the account closes.^1,3

How the case reached a Dutch regulator

The route is worth tracing, because it shows what it took to produce this outcome. It began with 171 French drivers reporting their situation to the Ligue des droits de l'Homme, a French human rights organisation, which lodged a complaint with the French privacy regulator CNIL on the drivers' behalf.¹

Because Uber's European headquarters are in the Netherlands, the case moved to the Dutch authority under the GDPR's one-stop-shop mechanism. The Dutch regulator investigated in close cooperation with its French counterpart and aligned the decision with other European supervisors.¹

So the sequence was: individual drivers, a civil society organisation, one national regulator, a second national regulator, and roughly four years. That is what it currently costs to establish that an automated deactivation needed a human in it.^1,2

The size of the number, and what it means

European privacy fines are capped at 4 percent of a company's worldwide annual turnover. The authority notes Uber's global turnover was around 44.5 billion euros in 2025. Quartz and MediaNama report the penalty as the second largest ever issued under the GDPR, behind the 1.2 billion euro fine Ireland's regulator imposed on Meta in 2023.^1,2,3

This is also the fourth fine this authority has imposed on Uber: 600,000 euros in 2018, 10 million in 2023, 290 million in 2024, and now this. Uber is contesting the last two, and those proceedings are still running.¹

Uber has appealed this one as well. Nothing here is settled, and the amount that is eventually paid, if any, may differ considerably from the number in the announcement.^1,3

What to do if an account is closed automatically

None of this creates a fast route to getting an account restored, and it would be dishonest to present it as one. What it does create is a set of specific requests that a company has a legal reason to answer rather than absorb into a support queue.^1,3

• Ask in writing whether the decision was made by automated processing. That question is the one with a legal obligation attached to it.
• Request a human review of the decision, using those words, rather than asking for the account to be reinstated.
• Ask what data the decision was based on. A subject access request is a separate right and often produces more than a support ticket does.
• Keep the dates. When the account closed, when you asked, what came back and when. Regulators act on patterns, and a pattern needs records.
• If the platform is based in the European Union, a complaint goes to a national data protection authority. The Uber case shows this route working, and also shows it taking years.

Why this reaches past ride-hailing

Automated account decisions are ordinary infrastructure now. Sellers lose marketplace accounts, creators lose monetisation, couriers lose access to shifts, and freelancers lose platform profiles. In most of those cases the person is told the decision was made and not who made it or how to have it reviewed.^1,3

The finding here does not depend on anything specific to driving. It depends on two facts: the decision was made by software alone, and it materially affected the person. Those two facts describe a very large number of systems currently in operation.^1,2

For someone whose income runs through a platform, the practical takeaway is a vocabulary rather than a remedy. If an account is closed automatically, there is a named right to a human review and a named right to be told that automation was used. Asking for both, in writing, is a considerably stronger position than asking for the account back.^1,3

It should also be said plainly that a fine four years after the fact does nothing for the drivers who lost their income in 2019. The enforcement worked. It worked slowly, and the delay is part of the story rather than a footnote to it.^1,2