What happened
The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) issued a decision (dated August 17, 2026, publicly reported August 21, 2026) fining Uber €825 million ($966 million) for violating GDPR's prohibition on fully automated decision-making. The AP found Uber deactivated driver accounts — sometimes permanently — using automated software with no meaningful human review, and failed to adequately inform affected drivers, violating both the Article 22 automated-decision-making prohibition and the right to be informed. This is the second-largest GDPR fine ever issued, behind only Meta's €1.2B fine. Uber says it will appeal.
Why it matters
This is a landmark enforcement action applying GDPR's automated-decision-making protections directly to an AI/algorithmic-management use case at massive scale, confirming EU regulators will impose nine-figure penalties on companies that let algorithms make consequential decisions about people (e.g., account suspension, employment-adjacent decisions) without meaningful human review. It sets a strong precedent for any organization using algorithmic/AI systems for consequential decisions affecting gig workers, employees, or consumers in the EU.
Action needed
Organizations using automated/algorithmic systems for consequential decisions (account suspensions, denials, terminations) affecting EU data subjects should immediately audit for meaningful human review, contestability mechanisms, and Article 13/14 transparency disclosures; Uber's appeal should be monitored for legal-standard clarification.