Uber's €825 Million Lesson: When Software Fires People, Regulators Bite Back

On 8 October 2026, the European Data Protection Board gave the widest possible circulation to a decision that every platform with an automated suspension button should read twice. The Dutch data protection authority, the Autoriteit Persoonsgegevens, had fined Uber €824,990,000 for letting software decide, on its own, when a driver stopped earning. The fine was first announced in August, but its EU-wide publication this month is what makes it land: this is now the shared reference case for automated decision-making enforcement in Europe.

The facts are stark. Between 2018 and 2022, Uber's systems temporarily suspended driver accounts on suspicion of fraud, and permanently deactivated drivers whose passenger ratings stayed low for long enough, all without a person meaningfully reviewing the case first, and without drivers being told enough about how the decision was reached. The authority's deputy chair, Monique Verdier, put it plainly: "A computer should not make decisions on its own that have such major consequences." Uber disputes the finding, says its policies always included human review, and is appealing. The appeal matters less than the theory behind the fine: losing income because of an automated deactivation counts as a decision with legal or similarly significant effects, and regulators will treat it that way.

At just under €825 million, the penalty is the second-largest GDPR fine ever imposed, behind only the €1.2 billion Ireland levied on Meta in 2023, and it is the largest fine ever imposed anywhere for automated decision-making. It is also not an isolated event. In the same week it circulated, California enacted three new laws governing workplace AI, and Connecticut's new AI and privacy regime took effect. Automated decisions about workers are becoming a compliance topic on both sides of the Atlantic at once.

How 171 complaints became an €825 million problem

The case started small. Brahim Ben Ali, a former Uber driver in France, had his account deactivated in 2019. He collected testimonies from 170 other drivers, with help from PersonalData.io, a Swiss nonprofit focused on digital rights, and brought the complaint to the Netherlands, where Uber's European headquarters are located. Under the GDPR's one-stop-shop mechanism, the Dutch authority took jurisdiction for the whole EU. A handful of individual complaints, properly channelled, escalated into the second-largest fine the regulation has ever produced.

The regulator's finding had two legs. Article 22 of the GDPR gives people the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect them, with narrow exceptions and safeguards such as meaningful human intervention and the right to contest. The Dutch authority found that neither the fraud-triggered temporary suspensions nor the rating-triggered permanent deactivations cleared that bar. The second leg, Article 13, concerns transparency: drivers were not given adequate information about the logic, significance and consequences of the automated decisions. The pairing matters because a transparency failure is an independent infringement, meaning that even a compliant human-review process would not cure an undisclosed automated one.

Article 22 stops being theoretical

For eight years, Article 22 was the clause everyone cited in a policy document and nobody enforced. It was considered hard to apply, hard to prove, and not where regulators were looking. The Uber decision changes the calculus. It shows regulators are willing to look inside the machinery of a deactivation and ask the simple question: did a person actually decide this? If the human's role was to rubber-stamp machine output, the answer is no, and the fine can be enormous.

The fine is not for a breach. It is for a design choice: software that could end a livelihood with no person in the loop and no honest explanation.

The reach goes well beyond ride-hailing. Any platform that suspends accounts algorithmically sits inside the same theory: marketplaces that delist sellers, creator platforms that demonetize channels, gig-work intermediaries that deactivate couriers. Losing access to a worker's main source of income sits squarely in the category of decisions with similarly significant effects. Companies have often treated these flows as operational rather than legal events, something for trust-and-safety dashboards rather than data-protection impact assessments. As of October 2026, that distinction is no longer defensible.

The same fight on the other side of the Atlantic

The United States has no GDPR, but state by state it is building a patchwork aimed at the same behavior. California enacted three new laws in October 2026 governing employer use of AI in layoffs, workplace monitoring, discipline and termination, separate from the California Consumer Privacy Act's automated decision-making rules. The updated Cal/WARN and workplace-surveillance requirements take effect January 1, 2027, and the rules for automated discipline and termination decisions take effect July 1, 2027. Employers have the rest of 2026 to identify covered systems and update their notices.

Connecticut moved first. On October 1, 2026, the state's AI Responsibility and Transparency Act and an expanded data privacy law took effect together, one of the most expansive state AI and privacy frameworks in the country. Generative AI subscription providers must give written notice of key terms and obtain written acceptance, whistleblowers on large frontier models get new protections, a data broker registration framework comes in, the sale of residents' genetic information is prohibited, and businesses using personal data to customize prices face new limits and disclosure rules. Employers using automated hiring tools must give plain-language notice, and using a third-party algorithm does not outsource discrimination liability.

The direction of travel is consistent: on both sides of the Atlantic, automated decisions about people's work are moving from an HR operations question to a regulated data practice, with disclosure and genuine human review as the price of admission.

What the case clarifies, in three observations

First, the human reviewer has to be able to say no. A workflow where a person clicks through a queue of machine-made decisions in seconds is not meaningful human involvement, whatever the org chart says. Second, the explanation is a requirement, not an afterthought. Drivers in the Uber case could not get a straight answer about why they were deactivated, and that alone was a separate infringement under Article 13. Third, expect the complaint pipeline to keep working. The Uber case shows that 171 drivers, one former driver and a small nonprofit can set the agenda for a continent's regulator. The scale of the enforcement followed the scale of the harm, not the size of the complainant.