Dutch data regulator fines Uber about $966 million over automated driver-account deactivations

The Dutch Data Protection Authority, known as AP, has decided to fine Uber €825 million (about $966 million) under European data protection rules, according to a report that says the decision was issued after the regulator concluded Uber deactivated driver accounts through automated systems without adequately meeting required safeguards.

The case centers on how Uber’s systems handle driver suspensions and account status changes. Rather than leaving suspensions entirely to manual review for every instance, the report says Uber used automation in the process, and that automation contributed to the regulator’s findings that the company did not provide sufficient protections expected under the EU’s approach to personal data and automated decision-making.

In the regulator’s view, the issue was not only whether Uber made decisions about access to the platform, but whether it did so in a way that respected data-protection requirements, the report indicates. Those requirements, set out in EU law, include expectations for lawful processing, transparency, and appropriate controls when decisions about individuals are influenced by automated processes.

The report describes the AP decision as an enforcement action under the EU’s data protection framework. The size of the fine underscores that regulators can impose substantial penalties when they determine that a company’s handling of personal data systems falls materially short of the legal standard, particularly in high-volume consumer and workforce platforms.

Uber is publicly listed on the NYSE under the ticker UBER, and like other ride-hailing and delivery platforms, it relies on automated tools to manage driver eligibility, safety monitoring, and account operations at scale. Automation is often used to speed investigations and implement restrictions quickly, but the AP action suggests that speed and scale do not remove the obligation to build in legal safeguards around how personal data is used to make or support decisions about individuals.

The report also indicates that the regulator’s case was sufficiently detailed to reach a final decision, not just an inquiry. However, the report, as presented in the news item, does not disclose operational specifics such as which exact automation steps were deemed inadequate, what categories of drivers were affected, whether Uber had internal appeal or review workflows for suspended drivers, or how the regulator assessed the quality and monitoring of the automated system.

The company was not described in the report as agreeing or disagreeing with the AP’s findings within the materials available here. As with many regulatory enforcement actions, some elements typically clarified later, such as whether Uber plans to challenge the fine in court and what remedy steps, if any, it will implement beyond paying the penalty, are not spelled out in the brief report description.

What to watch next is whether the AP’s decision becomes fully available through official publication, and whether Uber responds with procedural or technical changes to its driver suspension tooling. Regulators across Europe have increased attention on automated decision systems that affect individuals, so the outcome may influence how other platforms document, justify, and govern similar automated account-status processes.