The Dutch authority, in cooperation with the National Commission on Informatics and Liberties (CNIL), sanctions Uber for implementing a driver account deactivation system based on fully automated decision-making, in violation of the GDPR, and for failing to provide information about it.

Facts and context

The Dutch Data Protection Authority (AP) today published a sanction decision against Uber, including the imposition of a fine of €824,990,000, for breaches related to fully automated decision-making resulting in the deactivation of its drivers' accounts.

The case originated from a complaint filed by the Human Rights League (LDH) on behalf of 171 French drivers with the French supervisory authority, leading to an investigation by the Dutch authority as the lead authority, Uber's main European establishment being located in the Netherlands.

Grounds for the decision

The authority found two main breaches against the company:

• Obligation to ensure human intervention in automated decision-making (Article 22 of the GDPR): The authority found that between 2018 and 2022, Uber used software to automatically deactivate driver accounts in cases of suspected fraud or customer ratings deemed insufficient. The authority considered this practice to be a fully automated decision producing legal effects or significantly affecting the data subjects, namely the suspension of their source of income. The complete absence of human intervention in this process was deemed a direct violation of the principle prohibition set by the GDPR.
  
  The authority also noted that Uber did not provide drivers with sufficient and clear information about the existence of this automated decision-making process, which prevented drivers from understanding the underlying logic, the importance, and the intended consequences of this processing, in violation of transparency principles.

Authority's decision

Consequently, the authority imposed a fine of €824,990,000 on Uber.

Lessons learned

This decision reminds that:

• A decision producing legal effects or significantly affecting a person, such as the suspension of a professional account resulting in loss of income, cannot be based on exclusively automated processing.
• The human intervention required to validate a high-impact automated decision must be effective and meaningful, and cannot be limited to a mere formal validation of the algorithm's result.
• The information provided to data subjects about the existence of automated decision-making must be clear, complete, and include explanations about the underlying logic and intended consequences.
• The use of algorithms for fraud detection, although potentially legitimate, does not exempt from the prohibition of fully automated decision-making if it leads to significant negative consequences for the individual.
• Within the one-stop-shop mechanism, a complaint filed with a local supervisory authority can trigger an investigation and sanction by the lead authority of the country where the controller's main establishment is located.