In August, Uber was issued with an €825m fine by the Dutch data protection authority for taking unlawful automated decisions to suspend and deactivate driver accounts.
While data protection authorities rarely use the full extent of their fining powers under the GDPR, this is a notable exception, with the automated decision making fine amounting to almost 2% of Uber’s 2025 worldwide annual turnover. As you would expect, Uber has appealed against the fine.
The Uber drivers’ complaint was based on a process that automatically suspended drivers where they had low customer ratings, or where they were suspected of fraud. When customer ratings were persistently low, drivers had their Uber accounts deactivated permanently.
On one level, that doesn’t sound unreasonable. In any job, you would expect their to be consequences for poor performance or suspected fraud. Uber’s problem, the Dutch data protection authority has found, was that its process wasn’t compliant with Article 22 of the EU GDPR.
Article 22(1) says (paraphrasing) that individuals have a right not to be subject to a decision based solely on automated processing of their personal data where that decision will have a legal or similarly significant effect on them (an automated decision, for the purposes of this article).
There are three exceptions to that right, but even when an exception applies, there is still a requirement to implement suitable measures to safeguard the right granted by Article 22(1). Two of the three exceptions explicitly require that the individual affected by an automated decision be given the opportunity to contest the decision with a human being.
The UK position
Since the passage of the Data (Use and Access) Act 2025, the UK now offers a more permissive framework for automated decisions than the EU. This does not mean that the process Uber operated with its drivers would have been legal in the UK.
It is true that UK law now offers legitimate interests as a lawful basis for implementing automated decisions (unlike the EU, where only the only available legal bases are contract, legal obligation and consent). However, automated decisions carried out on the basis of a legitimate interest are only lawful if various safeguards have been put in place for affected individuals. For example:
Providing information about your automated decisions
Offering a way to contest automated decisions, including a mechanism to obtain a human review
Comment
The lesson from the Uber case is this: while automated decisions can drive efficiency, you need to make sure that a human remains available to step back into the loop where affected individuals feel that the automation is producing an unfair result.
If you are looking to start making more automated decisions in your business, for legal and reputational reasons, you need to get a good grip on the compliance issues first. Mills & Reeve’s data protection team can help you identify the most appropriate lawful basis for processing personal data and advise on the necessary safeguards.
Our content explained
Every piece of content we create is correct on the date it’s published but please don’t rely on it as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.