Uber Hit with €825 Million Fine in Netherlands Over GDPR Violations for Auto-Deactivating Driver Accounts

The moment their accounts were deactivated, drivers didn't receive a call from customer service—just a system notification. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) has determined that between 2018 and 2022, Uber repeatedly deactivated driver accounts through a fully automated process, with no human review involved, in violation of the EU's General Data Protection Regulation (GDPR). The ruling has resulted in a fine of €824.9 million—roughly $966 million—the largest penalty Uber has ever received in the Netherlands.

The investigation began with complaints from 171 French drivers. They reported to a local human rights organization that their accounts had been deactivated overnight, cutting off their source of income. Since Uber's European headquarters is based in the Netherlands, the case was eventually handed over to the AP for handling.

"Their Uber income just disappeared, gone," said AP Vice-Chair Monique Verdier regarding the drivers who filed complaints. "Computers shouldn't be making decisions on their own that have such a major impact on you."

This marks the fourth time the AP has fined Uber. In 2018, the AP fined Uber €600,000 (about $701,000) over a data breach; in 2023, it issued a €10 million (about $11.6 million) fine; and in 2024, it hit Uber with a record-breaking €290 million (about $339 million) penalty for improperly transferring European drivers' personal data to the US. This latest €824.9 million fine, according to the AP, represents the maximum penalty allowed under the cap of 4% of the company's global annual revenue.

Uber has appealed the ruling. Engadget says it has reached out to Uber for comment but has not yet received a response.