Dutch DPA Fines Uber €825 Million for AI-Driven Driver Deactivations Without Human Review

The Dutch Data Protection Authority has fined Uber €824.99 million for running an automated driver deactivation system that terminated workers without meaningful human review—the most significant enforcement test yet of GDPR's limits on AI-driven employment decisions. Every platform that uses algorithms to manage gig workers across the EU now faces direct regulatory exposure.

Background: the rule Uber broke

Article 22 of the GDPR has existed since the regulation took effect in 2018. It gives individuals the right not to be subject to decisions based solely on automated processing when those decisions produce "significant effects" on them. Enforcement against AI employment systems has been sparse—until now.

Uber's driver deactivation system flags accounts based on performance metrics, complaint patterns, and behavioral signals, then terminates platform access algorithmically. For drivers who depend on the app as their primary income source, losing access is a consequential employment action: no review, no income, no recourse in any meaningful timeframe. The Dutch DPA found that Uber executed these decisions without a genuine human in the final decision loop, in direct violation of Article 22.

The ruling in detail

According to Origin Brief's regulatory coverage, the authority's core finding rests on two elements: first, that losing access to your primary income source constitutes a decision with "significant effects" under Article 22—a threshold Uber did not dispute. Second, that Uber's process for reaching that decision was automated in a way that Article 22 explicitly prohibits without a genuine human review stage.

The €824.99 million penalty is the largest GDPR fine issued to date specifically targeting an AI-driven employment system. Prior landmark GDPR actions—Meta's €1.2 billion fine for data transfers, Amazon's €746 million for surveillance-based advertising—hit data practices. This ruling extends regulatory reach directly into algorithmic workforce management, a category the law has technically covered for years but regulators have been slow to pursue.

The DPA is not prohibiting automated tools in HR or platform operations. It is requiring that consequential employment decisions—account termination, suspension, material pay changes—include a genuine human decision point before execution. A human rubber-stamping an automated output does not satisfy this. The review must be substantive.

What this means for platforms

The implications extend well beyond Uber. Any company operating gig or platform-based labor in the EU faces the same Article 22 analysis:

• Automated performance management that results in account restrictions, pay reductions, or access changes needs a documented human review step before adverse action is finalized.
• AI-driven fraud detection that suspends accounts must build genuine human judgment into the process—not as a formality but as a real gate.
• Gig platforms across all sectors—logistics, delivery, domestic services, freelance marketplaces—face structurally identical exposure if their deactivation workflows are end-to-end automated.

The list of companies that should be reviewing their systems right now includes Deliveroo, Amazon Flex, Instacart's European operations, TaskRabbit, and dozens of logistics and ride-hail operators that have never faced Article 22 scrutiny at this level.

The EU AI Act compounds the pressure

The Dutch ruling arrives as the EU AI Act's employment provisions begin to take shape. Under the Act, AI systems used in employment and workforce management are classified as "high-risk" and subject to mandatory conformity assessments, human oversight requirements, and transparency obligations. Those provisions roll into effect through 2027.

Companies that have not started compliance mapping for their workforce AI now face two legal fronts simultaneously: Article 22 enforcement under GDPR, which applies today, and high-risk AI requirements under the AI Act, which apply on a rolling basis. The overlap is significant—both demand human oversight of consequential employment decisions, but from different legal angles and with different documentation requirements.

The enforcement trajectory

Fines of this scale rarely go uncontested. Uber will almost certainly appeal, and full resolution through European courts could take years. But the enforcement signal is clear regardless of appeal outcome: EU data protection authorities have the legal framework and the political will to pursue large platforms over AI employment practices.

Other national DPAs—in Germany, France, and Italy—have been observing similar gig economy cases. The Dutch ruling gives them a replicable blueprint: establish that the decision was automated, demonstrate that it produced significant effects on the worker, show that no genuine human review occurred. That's a clean three-part test that can be applied to any platform.

What to watch

Whether Uber's appeal succeeds will shape how aggressively other DPAs move against similar systems over the next 12–18 months. Parallel developments in the EU AI Act's enforcement machinery—particularly the formal classification of employment AI as high-risk—will determine whether the Article 22 exposure companies face today is compounded by a second, more prescriptive compliance layer starting in 2027. The more important short-term signal is whether other platforms begin proactively restructuring their deactivation workflows before regulators come to them.