Uber Hit With Nearly $1 Billion GDPR Fine Over Automated Driver Firings

The Dutch Data Protection Authority has fined Uber €825 million (approximately $966 million) for violating the General Data Protection Regulation (GDPR), according to reporting from TechCrunch. The penalty, the second largest ever issued under GDPR, follows an investigation into claims that Uber used automated processes to deactivate driver accounts without adequate warning or human review.

Monique Verdier, deputy chair of the Dutch regulator, stated that the company committed "serious infringements," asserting that computers should not independently make decisions with such significant consequences. While Uber told Reuters it disagrees with the "disproportionate fine" and maintains that no permanent deactivations occur without human review, Dutch regulators dispute this claim. Uber has announced it will appeal the decision.

TechCrunch reports that the regulatory action was spurred by complaints from a group of drivers, including Brahim Ben Ali, a former driver in France. Ben Ali collaborated with PersonalData.io, a Swiss digital rights nonprofit, to gather data on how deactivation decisions were reached. Paul-Olivier Dehaye, founder of PersonalData.io, noted that a single serious report can lead to enormous consequences for a driver regardless of their overall performance history.

This is the third fine the Dutch regulator has imposed on Uber, following previous penalties of €290 million and €10 million related to the handling of driver data. Dehaye indicated he plans to launch a class action lawsuit for driver compensation and is starting a new company, StartClaims, to support litigation against Uber and other gig economy entities.