Uber faces an €825M GDPR fine for automatically suspending drivers without human review, highlighting the risks of AI decisions affecting workers.

The Dutch Data Protection Authority handed Uber its largest privacy fine yet, and this one isn’t about data transfers or cookie consent. The regulator imposed an 825 million euro penalty, roughly $964 million, over Uber’s use of fully automated software to suspend driver accounts, sometimes permanently, with no human ever reviewing whether the system got it right.

The violation is clear under EU law. The GDPR limits fully automated decisions when they can significantly affect a person’s life. An algorithm that can take away someone’s ability to earn a living, without any human review, falls directly into this category. The regulator also found that Uber failed to properly tell drivers when automated systems made these decisions, which the GDPR requires companies to disclose.

“The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, imposes a fine of 824,990,000 euros on Uber. The reason for this is that the AP has ruled that Uber made fully automated decisions about drivers. In case of suspicions of fraud or customer reviews that were too low, drivers’ accounts were automatically temporarily deactivated or, in case of persistent low customer reviews, permanently deactivated. As a result, their income was lost via Uber during the deactivation.” reads the statement published by the Dutch data protection authority. “According to the AP, Uber has violated the prohibition of fully automated decision-making under the General Data Protection Regulation (GDPR). The AP also found that Uber did not sufficiently inform drivers about automatic decision-making. Uber has now stopped the violations.”

The fine covers Uber’s practices from 2018 to 2022, so it concerns systems the company has already discontinued. Uber highlighted this point in its response, arguing that the regulator examined old policies rather than practices still in use today.

“Uber used software to track drivers’ (driving) behaviour and to track customer reviews. If that software detected a suspicion of fraud or customer reviews were too low, the accounts of the drivers concerned were automatically deactivated.” continues the Dutch authority. “There was no human assessment here. This occurred between 2018 and 2022.”

Uber also said it takes decisions that affect drivers’ income seriously. The company pointed to human reviews, safeguards and an appeals process for drivers who believe the system made a mistake. The appeal will have to determine whether these protections existed during the period covered by the fine or came later.

And Uber is appealing. The company has stated it disagrees with both the decision and the size of the fine, setting up another round in what’s become a recurring pattern between Uber and Dutch regulators specifically.

This is the fourth time the Dutch authority has fined Uber, which on its own says something about the relationship here. The previous record holder was a 290 million euro fine in 2024 over transferring European drivers’ personal data to the US without adequate protections, a case Uber also appealed at the time. Four fines from a single regulator isn’t really a pattern of bad luck anymore; it’s a pattern of a company and a privacy regulator that keep disagreeing about the same basic question, how much human judgment has to sit between an algorithm’s decision and a person’s actual income.

The case goes beyond Uber. Many gig-economy platforms in Europe use algorithms to manage workers, routes and account status. This ruling shows the cost of relying on automated decisions without human oversight. For companies that use algorithms to make decisions affecting people’s accounts or income, saying “the algorithm decided” is no longer enough. The €825 million fine makes that lesson very clear.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

The Dutch DPA issued a massive $966 million Uber fine for violating GDPR rules with automated driver terminations. Learn how this impacts the gig economy.

Related Posts:

• YouTube Premium Prices Rise Across Europe and Singapore Starting September 23
• OneDrive Folder Exclusions Roll Out for Development Environments
• Claude Fable 5 Intelligence Drop Sparks Concerns

The post Uber Fined $966 Million for Automated Driver Terminations appeared first on Daily CyberSecurity.

It may sound entirely bizarre but the prices you once paid for hotels, educational classes, or staplers could have all been higher because you used a Mac computer, lived in a certain zip code, or lacked an Office Depot in your neighborhood.

No, really.

In 2012, The Wall Street Journal reported that the travel booking site Orbitz showed Mac users pricier hotel options than PC users, because the company had determined that Mac users spend, on average, 30% more a night on hotels. That same year, The Wall Street Journal (once again) reported that Staples.com showed higher prices to visitors who lived farther away from a competitor like Office Depot. And in 2015, the reporting outfit ProPublica revealed that customers in certain zip codes were shown higher prices for college test prep courses offered by The Princeton Review.

As that investigation found, if customers:

“type some zip codes into the company’s website, they are offered The Princeton Review’s premier course for as little as $6,600. For other zip codes, the same course cost as much as $8,400. One unexpected effect of the company’s geographic approach to pricing is that Asians are almost twice as likely to be offered a higher price than non-Asians.”

This is surveillance pricing put into action.

Under surveillance pricing, companies collect as much data as possible about consumers so that they can alter the literal prices those consumers pay for the exact same goods as everyone else. It is reportedly what caused some customers to see higher prices for televisions in the Target app when those customers were physically located in a Target parking lot. It is also allegedly why Home Depot customers in wealthy neighborhoods oddly paid less. And it is what Delta Airlines walked away from after public backlash.

The near-omnipresence of surveillance pricing is also why so many videos can be found online today that claim that minor alterations to a person’s data trail—like changing an IP address using a VPN or shopping for airline tickets on a public library’s computer—can lead to lower prices online.

The proof behind these claims, however, is harder to test.

Thankfully, one person has already tried.

Video journalist Chris Parr, known on YouTube as Chris the Producer, ran a wild experiment into whether he could “stress-test” surveillance pricing. Far beyond changing his IP address or making online purchases from different locations, Parr started from scratch. By first registering an LLC in the state of Wyoming, Parr granted that LLC both a credit card and a phone, effectively creating a brand new consumer persona to be tracked. But creating a realistic data trail for his LLC would require a little extra help—help that Parr received from an actor he hired for the part.

Today, on the Lock and Code podcast with host David Ruiz, we speak with Parr about his experiment into surveillance pricing, including a high-wire drone act to purchase a White Castle Crave Case in the air space above his home state’s wealthiest neighborhood:

“To the data collectors, they don’t know that this phone is floating in the air, like 200 feet in the air. They just see a geolocation on it.”

Tune in today to listen to the full conversation.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.