On 21 August 2026, the Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), fined Uber €824,990,000 for making fully automated decisions about its drivers. When the company's systems suspected fraud, or when drivers' customer ratings fell too low, driver accounts were deactivated automatically - temporarily, or permanently where low ratings persisted - cutting off their income through the platform without a person first reviewing the decision.
The AP found that Uber breached the GDPR's prohibition on decisions based solely on automated processing that significantly affect people (Article 22), and that it did not give drivers sufficient information about that automated decision-making (Articles 13 and 14). The conduct ran from 2018 to 2022. The AP acted as lead supervisory authority under the GDPR's one-stop-shop mechanism, in close cooperation with France's CNIL, after a complaint originating with drivers in France. Its deputy chair, Monique Verdier, said a computer should not make decisions on its own that have major consequences for people, and that such decisions should first have been looked at by a human being. Uber has said it strongly disagrees with the decision and the size of the fine and will appeal.
The fine is the second-largest ever imposed under the GDPR, behind Meta's €1.2 billion in 2023, and Uber's third from the AP after a €10 million fine and a €290 million fine over transfers of drivers' data to the United States, both in 2024. Its central point is narrow but consequential: a human review step only counts if it is real. Where a system's output takes effect without a person able to change it, the decision is fully automated in the GDPR's sense, whatever the process is called.
The same principle is about to be reinforced from the AI Act side. AI systems used to make decisions affecting work relationships, including their termination, are listed as high-risk in Annex III of the EU AI Act, with obligations - including human oversight - applying from 2 December 2027 under the AI Omnibus timeline.
Acompli perspective: The Uber decision draws a clear line between software that assists a decision and software that makes it. Organisations using automated or AI-driven decisions about people should record where a person reviews the outcome, what that person can change, and the evidence they saw - and should assess the processing before it goes live through a DPIA. Classifying the AI systems involved against the EU AI Act's high-risk categories, and keeping the human-oversight evidence alongside the GDPR record, is the purpose of Acompli's EU AI Act workflow. Acompli applies the same rule to itself: AI drafts and classifies, and a named reviewer approves before anything becomes a record.