The Dutch Data Protection Authority has fined Uber 825 million euros, about $966 million, over the use of automated processes to suspend driver accounts without sufficient human oversight, TechCrunch reports. It is the second-largest penalty issued to date under the General Data Protection Regulation.
The regulator found that Uber had "committed serious infringements". Its deputy chair, Monique Verdier, framed the finding in a single line: "A computer should not make decisions on its own that have [such] major consequences." The bracketed word is the regulator's own clarification as the source presents it.
What the rule actually says
The relevant part of the GDPR is narrower than "companies must not use algorithms". It concerns decisions taken solely by automated means that produce legal effects or similarly significant effects on a person. Losing the account that generates your income is the textbook example of a significant effect, which is why deactivation, rather than data collection, is the issue here.
The question in such a case is therefore not whether software was involved. It is whether a human being with the authority to decide otherwise looked at the decision before it took effect.
Uber's answer
Uber disputes the findings and says it will appeal. Its argument is that most suspensions are brief, that permanent deactivations do involve human review, and that drivers can appeal a decision affecting their account. A company statement said: "We strongly disagree with this decision and disproportionate fine."
Those two positions are not simply one side saying yes and the other no. The regulator and the company appear to disagree about the facts of how the system works, not only about how the law applies to it, and an appeal is where that gets tested.
Where the case came from
Brahim Ben Ali, a French driver, lost his account in 2019 and gathered testimony from 171 other drivers. The complaint was filed in the Netherlands, where Uber's European headquarters are based, which is why a Dutch regulator is the one issuing a fine over the treatment of drivers in France and elsewhere. Under the GDPR, a company's main European establishment determines which national authority leads.
This is the third Dutch fine against Uber over its handling of driver data, following penalties of 290 million euros and 10 million euros.
Paul-Olivier Dehaye of the digital rights nonprofit PersonalData.io said he plans to launch a class action allowing drivers to seek compensation. A regulatory fine is paid to the state, not to the drivers, so a separate claim is the only route by which any of them would be paid.
What we could not establish
We could not establish how many drivers were affected, over what period, or what proportion of deactivations the regulator found to be fully automated. We could not reach the regulator's own published decision, which returned an error, and we verified this account from a single publication.
