Uber’s record GDPR fine highlights the importance of transparency, human oversight and effective safeguards in automated decision-making
We have silently allowed algorithms to choose the music we listen to, recommend the movies that would appeal to us, and decide the type of posts appearing on our screens.
But when did we agree to let algorithms decide whether we go to work tomorrow?
That question is at the heart of the Dutch DPA’s Autoriteit Persoonsgegevens (AP) latest decision against Uber, and the answer came with a fine of almost €825 million. According to the AP, Uber automatically deactivated drivers’ accounts for suspected fraud and low customer ratings, without providing sufficient information or a way to challenge the decision.
The case is important not merely because of the size of the fine, which is reportedly the second-largest GDPR fine to date, but because of the regulatory message behind it.
Automation itself is not the issue. Outsourcing the decision-making to algorithms can be.
Article 22 GDPR restricts decisions based solely on automated processing where they produce legal effects or similarly significantly affect individuals. In the Uber case, the Dutch DPA considered that losing access through the platform significantly affected drivers, as it meant losing their ability to generate income through it.
Not providing drivers with clear, accessible information about the decision-making process and their ability to meaningfully contest the outcome, appears to be a standalone transparency gap under Article 13 GDPR.
For organisations increasingly relying on algorithms and AI-supported tools in employment, platform management and other business areas, the case raises some very practical questions:
The practical takeaway? It may be worth bringing the relevant business, technology, legal and compliance functions into the process from the outset, rather than once the AI tool or process has been built and shipped.
Uber has announced that it will appeal, so the final legal position remains to be seen. For now, the decision offers a useful compliance reminder: human oversight needs to become an architectural and governance requirement, not simply a principle on paper.
Martin has not only been consistently providing high-quality legal service but has also become one of the youngest professors in Bulgaria and established himself undisputedly as the most prolific author in the law firm.
Nevena combines private-practice expertise with substantial in-house experience in technology-driven organisations, regulated compliance and legal-tech entrepreneurship. Her work reflects a practical understanding of how legal requirements affect products, people and business operations.
