Autoriteit Persoonsgegevens, August 21st, 2026
On August 21st, the Dutch data protection authority imposed a fine of €824,990,000 on UBER B.V. and UBER Technologies Inc. for implementing automated individual decisions concerning drivers using the Uber platform.
The CNIL, having received a collective complaint lodged in 2020 by the Ligue des droits de l’Homme on behalf of 171 French drivers, participated in the investigation of this case under the European cooperation mechanism provided for by the GDPR. This mechanism, known as the ‘one-stop shop’, applies to cross-border data processing and allows the data protection authority of the main establishment to act as the lead authority. In this case, the Dutch authority had jurisdiction, as the company’s main European establishment is located in the Netherlands.
This fine is one of the highest ever imposed under the GDPR.
On the existence of automated individual decisions
Article 22 of the GDPR recognises the right of every individual not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects or similarly significantly affects them, subject to the exceptions provided for in that same article.
In this case, the company used software to monitor drivers’ behaviour, enabling, in particular:
- the temporary deactivation of an account in the event of suspected fraud;
- the temporary or permanent deactivation of an account where the rating given by customers was deemed insufficient.
According to the Dutch authority, these decisions, taken between 2018 and 2022, were made without any genuine human intervention in the decision-making process. Yet their consequences were particularly significant for the drivers concerned.
Indeed, the deactivation of an account prevented the driver from accepting journeys and earning an income. Such a measure therefore directly affected their professional activity and financial situation.
Consequently, the authority considered that these deactivations constituted automated individual decisions within the meaning of Article 22 of the GDPR.
On the lack of information provided to drivers
The Dutch authority also noted that the company had not sufficiently informed drivers about the automated decisions to which they were subject.
The use of automated processing must, in fact, be brought to the attention of the data subjects in accordance with the conditions set out in the GDPR. In particular, the information provided must cover the existence of an automated decision, the underlying logic, and the significance and anticipated consequences of such processing, in accordance with Articles 13 and 14 of the GDPR.
Indeed, the compliance of an automated system does not depend solely on its technical functioning. It also requires that individuals understand the existence of the system and its role in the decision-making process.
On the penalty imposed
Given the seriousness of the infringements identified and the number of individuals affected, the Dutch authority imposed a fine of 824,990,000 euros. In assessing this amount, the authority noted that the company had achieved a global turnover of approximately 44.5 billion euros in 2025. In this regard, the authority pointed out that fines under the GDPR can amount to up to 4 per cent of a company’s global annual turnover.
This is the fourth fine imposed by the Dutch authority on this company. The company had previously been fined €600,000 in 2018, €10 million in 2023 for breaches of the duty to provide information, and €290 million in 2024 in relation to international data transfers.
Finally, the company has rectified the breaches identified and has contested this new sanction.
