Uber's €825 Million Fine: What Article 22 Means for Automated Decisions About People

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has fined Uber B.V. €824,990,000 for taking fully automated decisions about drivers and for not telling them enough about it. The decision was published through the European Data Protection Board on 8 October 2026. It is the largest GDPR fine announced in 2026 so far, and a rare one to rest on Article 22 — the rule about decisions made by machines alone. Uber has appealed and there is no final judicial decision; the authority also records that the practices have stopped.

What Uber did

Between 2018 and 2022, according to the authority’s findings, Uber’s systems deactivated drivers’ accounts without human involvement: temporarily, where fraud was suspected or customer ratings fell too low, and permanently where ratings stayed low. A deactivated driver could not earn through the platform. The case began with complaints from 171 drivers in France, brought to the French regulator by the Ligue des droits de l’Homme, and was handled by the Dutch authority as lead supervisory authority under the one-stop-shop because Uber’s European headquarters are in the Netherlands.

Two provisions were breached. Article 22 gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects on them, unless the decision is necessary for a contract, authorised by law or based on explicit consent — and even then, with safeguards: the right to obtain human intervention, to express their point of view and to contest the decision. Article 13 requires a controller to tell people, when it collects their data, that such decisions are made, with meaningful information about the logic involved and the significance and consequences for them.

Why it matters beyond gig platforms

Losing your income is an obvious “similarly significant” effect, but the category is wider than that: refusing credit, declining an application, suspending an account, setting a price for one person, flagging a customer as a fraud risk. Any business that lets a system decide one of those outcomes without a person who can genuinely change it is in Article 22 territory. Human involvement that merely rubber-stamps the machine does not take a decision out of the article; the person must have the authority and the information to decide differently.

In the United Kingdom the rule changed on 5 February 2026. The Data (Use and Access) Act 2025 replaced Article 22 with Articles 22A to 22D of the UK GDPR, which allow a significant automated decision to be taken on any lawful basis provided the safeguards are in place, with tighter limits where special category data is involved. The safeguards — information, a route to make representations, human intervention, the ability to contest — are the same ones Uber was found not to have offered. Our guide to the Act’s changes has the dates.

What to do

1. List every decision about a person that a system takes or recommends, and mark the ones a human cannot or does not override in practice.
2. For each of those, identify the lawful route (contract, law, explicit consent in the EU; a lawful basis plus safeguards in the UK) and write down the safeguards.
3. Say so in your privacy notice: that the decision is automated, the logic in meaningful terms, and the consequences.
4. Carry out a data protection impact assessment where the processing is likely to result in a high risk — Article 35 names systematic and extensive evaluation of people that leads to decisions with legal or similarly significant effects as a case where one is required.
5. Build the appeal route before you need it: a way for the person to contest the decision and reach someone who can reverse it.

Our DPIA service starts with exactly that inventory. We will update this article if the appeal changes the decision.