The figure became the second largest fine ever issued under the European Union’s General Data Protection Regulation, behind only the 1.2 billion euro that Ireland imposed on Meta in 2023, and it overtook the 746 million euro Luxembourg levied on Amazon in 2021, a penalty a Luxembourg court set aside on procedural grounds in March this year.

The number drew the headlines. The reasoning is what should worry boardrooms. The regulator found that between 2018 and 2022 Uber let software decide, on its own, when a driver stopped earning.

Where the company’s systems suspected fraud, an account was switched off automatically for a period.

Where a driver’s customer ratings stayed low for long enough, the regulator says the account was switched off for good, again by machine.

In neither case, the watchdog found, was there a human being who looked at the file before the driver lost access to the platform, and drivers were not told enough about how the decision had been reached to have any realistic chance of challenging it.

Monique Verdier, the authority’s deputy chair, put it plainly. Drivers, she said, went from earning to not earning in an instant, with no warning and no person involved.

“A computer should not make decisions on its own that have such major consequences,” she said.

A human should have reviewed the case first.

Uber does not accept the finding.

“We strongly disagree with this decision and disproportionate fine,” a company spokesperson said, adding that Uber takes drivers’ rights seriously and that its policies include both human review and a route for drivers to dispute a suspension.

The company says it will appeal, which moves the case into the Dutch courts, where the penalty can be upheld, reduced or thrown out.

Uber has already contested the regulator’s two previous large fines against it, and neither of those disputes has concluded.

What Uber is accused of doing
The GDPR has been in force since May 2018. Article 22 of the regulation gives every person in the EU the right not to be subject to a decision based solely on automated processing where that decision has legal effects or otherwise significantly affects them.

There are exceptions, but even where an exception applies the person is entitled to safeguards, including the right to obtain human intervention, to express their point of view and to contest the decision.

A second set of provisions requires organisations to tell people when automated decision-making of this kind is taking place and to explain the logic behind it.

The Dutch authority found Uber in breach on both counts. On the first, the regulator’s view is that switching off a driver’s account is about as significant an effect as a decision can have, because it removes the driver’s livelihood on the platform for as long as the block lasts.

The French data protection authority, the CNIL, which worked on the case with its Dutch counterpart, described the practical effect in the same terms. Once an account was blocked, the driver could accept no rides and earn no money through Uber, and there was no human involvement in reaching that outcome.

The examples the regulators give are ordinary features of ride-hailing. Uber’s systems flagged drivers who appeared to have taken unnecessary detours to inflate a fare, or who accepted a trip with no intention of completing it. Those flags led to automatic suspensions.

ALSO READ | Uber makes big-ticket investment commitment in self-driving startup Nuro

Separately, drivers whose ratings from passengers fell below the threshold Uber set were suspended and, the regulator says, in persistent cases removed permanently.

On the second count, the regulator found that drivers were not properly informed. They were not told that a machine was making the call, and they were not given enough information about why, which left them unable to argue their case.

Uber’s defence rests on two points. The first is factual. It says it has never used automation to make a permanent deactivation decision, that most suspensions are short, and that a human reviews any permanent removal. The second is proportionality.

Uber says relatively few drivers were affected, and points out that 126 drivers across Europe were deactivated for low ratings in 2021. It also says the policies under examination were discontinued years ago and that its current process includes human evaluation and a clear appeal channel. The Dutch authority itself confirms that Uber has stopped the practices it objected to.

Why the bill is so large
The regulator did not arrive at 825 million euro by counting affected drivers and multiplying. GDPR fines are set by reference to the seriousness of the breach and then capped at a share of the offender’s worldwide turnover.

For the most serious categories of breach, which include violating Article 22, that cap is 4%. All European privacy regulators use the same method, and the Dutch authority aligned its decision with other supervisors across the bloc before issuing it.

Uber’s global revenue in 2025 was about 44.5 billion euro. Four per cent of that would have been roughly 1.78 billion euro.

The penalty imposed works out at about 1.85% of turnover, less than half the maximum, but the base figure is Uber’s entire worldwide business, not its European ride-hailing arm and certainly not the fraction of European drivers who were deactivated.

That is the design of the law. It was written so that a global company could not treat a European fine as a rounding error, and it explains why a dispute that Uber frames as involving a small number of drivers has produced one of the largest privacy penalties in history.

The Netherlands got the case because Uber’s European headquarters is in Amsterdam. Under the GDPR’s one-stop-shop rule, the regulator in the country where a company has its main European establishment leads cross-border investigations.

The complaint began in France, with the human rights group Ligue des droits de l’Homme, and reached the Dutch authority via the CNIL.

This is the fourth Dutch fine on Uber. The regulator imposed 600,000 euro in 2018, 10 million euro in 2023 and 290 million euro in 2024, the last of those for transferring drivers’ personal data to the United States without adequate safeguards.

Paul-Olivier Dehaye, founder of the Swiss digital rights group PersonalData.io, which helped drivers obtain their data, has said the fines all trace back to complaints from the same group of drivers.

The man who started it
That group formed around Brahim Ben Ali, a former Uber driver in France whose account was deactivated in 2019.

According to the Dutch newspaper de Volkskrant, Ben Ali gathered testimonies from about 170 other drivers before taking his complaint to the Netherlands, with PersonalData.io helping the drivers use their data access rights to find out how decisions about their accounts had been made.

Dehaye’s description of the problem is the one that resonates with drivers.

A driver can complete a thousand journeys with satisfied passengers, he has said, but “if just one person reports a very serious problem, the consequences can be enormous.”

Dehaye is now setting up a company called StartClaims to support litigation and further regulatory action, starting with Uber and later extending to other gig economy platforms and to advertising technology.

PersonalData.io has said it is preparing a class action seeking compensation for drivers.

That matters for the arithmetic. A regulatory fine goes to the state. Compensation claims go to the people who lost income, and under the GDPR individuals can seek damages for harm caused by a breach.

If the Dutch decision survives appeal, it becomes a ready-made finding of fact on which such claims can be built. The 825 million euro may be the first bill rather than the last.

The timing is the story
What lifts this case above a large number and a corporate appeal is the calendar. On July 27, Regulation (EU) 2026/1744, known as the “Digital Omnibus on AI,” entered into force. Its centrepiece was a delay.

The EU AI Act’s rules for high-risk systems listed in its Annex III, a list that expressly covers software used in recruitment, task allocation, monitoring and the termination of work relationships, had been due to apply from August 2 2026.

The omnibus pushed that date to December 2 2027. Systems embedded in products already regulated under EU safety law got until August 2 2028.

Businesses read the delay as breathing space, and law firms across Europe wrote client notes telling them that the heaviest compliance regime had moved out by sixteen months. Three weeks later the Dutch regulator signed a decision that made the point the other way.

It did not cite the AI Act. It did not need to. It reached for a provision that has been in force since 2018 and that most companies had filed under privacy rather than employment, and it used that provision to penalise precisely the kind of automated dismissal decision the AI Act’s high-risk rules were meant to govern.

The lesson is uncomfortable. The AI Act delay changed when companies must document, test and register their high-risk systems.

It changed nothing about whether they may let those systems make consequential decisions about people without a human in the loop. That question was settled eight years ago, and the answer was no.

Nor is the GDPR the only older instrument in play. The EU’s Platform Work Directive, adopted in 2024, requires member states to write human oversight of algorithmic management into national law by December 2 2026, a year ahead of the AI Act deadline.

Dutch courts have also already ordered Uber and its rival Ola to explain automated decisions to drivers in cases brought by driver groups.

The regulatory floor under algorithmic management was built well before the AI Act, and it is the floor, not the ceiling, that companies are now tripping over.

Why this reaches far beyond ride-hailing
Uber is the defendant, but the practice it is accused of is widespread. Over the past decade thousands of companies have moved recruitment screening, performance scoring, productivity monitoring and in some cases dismissal recommendations onto software.

The stated reasons are consistency and speed. The unstated reason is cost. A human reviewer is expensive, and the whole economic logic of automating a decision is that no human needs to look at most cases.

The Dutch decision attacks that logic directly. If a decision significantly affects a person, the GDPR says a human must be able to intervene, and regulators have been clear for years that the intervention must be meaningful.

A person who glances at a screen and clicks approve on whatever the model recommends is not a safeguard. That means the cost saving from automation shrinks the moment the decision becomes consequential, and it means that a company which cut its review staff on the assumption that the software could be trusted now carries a liability it did not book.

Not everyone agrees with the regulator’s framing.

The technology commentator John Gruber argued that the decision risks making it unlawful for Uber to police drivers who scam passengers or leave them stranded, and that describing a computer as the decision-maker is like blaming the time clock when a habitually late employee is dismissed.

The rules, in his view, were set by managers and the software merely tracked whether they were followed.

Dehaye’s response was that Uber remains free to discipline drivers who cheat, provided a person makes the decision and the company takes responsibility for it. That is, in substance, what the regulator is asking for.

The GDPR does not ban fraud detection or rating systems. It bans handing the final, livelihood-ending decision to the machine and walking away.

What happens next
Uber’s appeal will take years. Its earlier disputes with the Dutch regulator over the 2023 and 2024 fines are still unresolved, and Meta’s challenge to the 1.2 billion euro Irish fine, now more than three years old, is a reminder of how slowly these cases move.

The Amazon precedent cuts both ways. A court did annul that fine in March, but on the grounds that the regulator had not properly assessed fault and proportionality, while endorsing the finding that Amazon had broken the law.

Uber’s best argument on appeal is the same one, that the sum is out of proportion to the harm.

The political backdrop will not help. Washington has repeatedly threatened retaliation against European penalties on American technology companies, and a fine approaching a billion dollars on a US ride-hailing group adds to that pile.

For everyone else, the practical questions are simpler. Which decisions about staff, contractors and customers does the company currently allow software to make alone? Which of those would a regulator regard as significant?

And where a human is nominally in the loop, would that person’s review survive scrutiny as a real check rather than a formality?

Companies that were planning to answer those questions in late 2027 have just been told the deadline passed in 2018.

The post Uber’s 825 million euro fine is a warning to every company that lets software fire people appeared first on International Finance.