Uber’s €825m fine puts a number on what human review has to mean
If your company switches anyone off automatically, whether that is suspending an account for suspected fraud, dropping a supplier below a score threshold, or screening applicants out of a hiring pipeline, a decision issued in the Netherlands on 24 August has just set the price of getting the human part wrong.
The Dutch Data Protection Authority, working with France’s CNIL under the GDPR one-stop-shop procedure, fined Uber B.V. and Uber Technologies Inc. €824,990,000 over the way it deactivated drivers’ accounts. The regulator found that suspending a driver for suspected fraud, and suspending or permanently removing one for low customer ratings, were automated individual decisions under Article 22 of the GDPR because of what CNIL describes as “the complete absence of human intervention in the decision-making process”.
What the regulator actually objected to
Not the automation. Article 22 does not forbid automated decisions, and no regulator expects a platform with hundreds of thousands of drivers to review every suspension by hand.
What it objected to was that the decisions carried real consequences and nobody meaningful sat in the loop. As the decision puts it, a blocked account means a driver can no longer make rides or generate revenue. That is the threshold Article 22 turns on: a decision producing legal effects or similarly significant ones for a person. Once you are over that line, a human has to be able to review the outcome, and be positioned to change it.
The distinction that matters, and the one most companies get wrong, is between a human who could intervene and a human who does. An appeals inbox nobody staffs, or a reviewer who only ever confirms what the model decided, is the first thing a regulator will take apart.
This is the third fine in the same case
The complaint behind it was brought in 2020 by La Ligue des droits de l’Homme on behalf of more than 170 Uber drivers. It has produced three penalties: €10 million in December 2023 for failing to inform drivers properly, €290 million in July 2024 for unlawful transfers of data outside the EU, and now €825 million for the automated decisions. One complaint, more than €1.1 billion.
That sequence is the part worth sitting with. The same set of facts was examined three times from three angles, and each pass found a separate violation with its own penalty. A privacy programme that fixes the issue a regulator names, and only that issue, is not finished.
What to ask about your own stack
Automated decisioning is no longer confined to platforms like Uber. It arrives inside ordinary tooling: fraud scoring in payments, risk scoring in vendor management, eligibility rules in HR systems, and increasingly through AI features switched on by default in software you already run.
Four questions worth putting to your own systems, and to any vendor selling you governance tooling for them:
- Which of our automated decisions significantly affect a person? Suspensions, rejections, price changes and eligibility calls usually qualify. Most companies have never listed them.
- Can we show a human reviewed a specific decision, and had the authority to reverse it? This is the question that decided the Uber case.
- Does our tooling evidence that review, or merely record that a review step existed? Plenty of platforms log the workflow. Far fewer produce something you could hand a regulator.
- Who owns this internally? Automated decisioning tends to sit between engineering, legal and operations, which in practice means nobody.
The test an AI-governance module has to pass
GRC and compliance-automation vendors have been adding AI-governance modules quickly, usually positioned around ISO/IEC 42001 and the EU AI Act. Article 22 is older, narrower and already fully in force, and it is where enforcement is landing now rather than later.
So when a platform offers AI governance, the useful test is not whether it maps to a framework. It is whether it can produce, for one named decision affecting one named person, a record of who reviewed it and what they were able to do about it. Ask for that in the demo, using a real decision your business makes.
Sources: CNIL, Automated decisions: UBER fined nearly EUR 825 million (24 August 2026) · GDPR Article 22