The Dutch Data Protection authority just made it clear that automating decisions in breach of Article 22 GDPR is not a trivial breach, but rather one that can result in a significant fine. This should serve as a warning for businesses that are automating important decisions in their business without sufficient human involvement (whether or not that decision is made by AI). 

Before you automate a decision that matters (e.g. recruitment, HR decisions, financial decisions), it would be worth asking the seven questions set out below.

Uber hit with €825 million GDPR fine over automated driver deactivations: What it means for UK businesses

The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), has imposed a fine of €824,990,000 on Uber for unlawfully using fully automated decision-making to deactivate drivers' accounts without any human review.

What happened?

Between 2018 and 2022, Uber deployed software to monitor drivers' behaviour and track customer ratings. Where the system detected suspected fraud or persistently low customer reviews, it automatically deactivated drivers' accounts - either temporarily or, in cases of ongoing low ratings, permanently. Drivers lost their income through the platform immediately and without warning, and crucially, no human being reviewed the decision before it was made.

The AP found that Uber had committed two distinct violations of the GDPR:

1. Breach of the prohibition on solely automated decision-making: Under Article 22 of the GDPR, individuals have the right not to be subject to decisions based solely on automated processing that produce significant effects on them. Account deactivation - and the resulting loss of income - plainly meets that threshold. Uber had no meaningful human intervention in the process.
2. Failure to inform drivers: Uber did not adequately inform drivers that automated decision-making was taking place, nor explain the logic behind it or its potential consequences, as required under Articles 13 and 14 of the GDPR.

The investigation was triggered by complaints from 171 French drivers, who reported their concerns to the Ligue des droits de l'Homme (LDH), a French human rights organisation. LDH filed a complaint with the French supervisory authority, the CNIL, on behalf of the drivers. As Uber's European headquarters are based in the Netherlands, the AP took the lead under the GDPR's one-stop shop mechanism, working in close cooperation with the CNIL and aligning the fine decision with other European supervisors.

The fine reflects up to 4% of Uber's worldwide annual turnover - Uber's global revenue was approximately €44.5 billion in 2025. Uber has filed an appeal.

This is the fourth fine the AP has imposed on Uber, following fines of €600,000 in 2018, €10 million in 2023, and €290 million in 2024 (both of the latter being contested and subject to ongoing proceedings).

What does this mean for UK businesses?

Although the AP is an EU regulator and the GDPR is an EU instrument (and, in case you missed it, the UK is no longer part of the EU), UK businesses should not treat this decision as irrelevant. 

The UK GDPR - which was retained in domestic law following Brexit - contains provisions on automated decision-making that are (even after the changes under the DUAA), still very similar to those in the EU GDPR. The Information Commissioner's Office (ICO) has the power to impose fines of up to £17.5 million or 4% of global annual turnover (whichever is higher) for serious breaches.

The Uber decision is therefore directly instructive for any UK business that uses automated systems to make, or substantially influence, decisions about individuals - particularly where those decisions affect people's livelihoods, employment, or access to services.

Key risk areas for UK businesses

1. Gig economy and platform models

Businesses operating workforce platforms - whether in logistics, food delivery, professional services or otherwise - that use algorithmic tools to manage, discipline, or remove workers are squarely in the firing line. If account suspension, task allocation, or performance scoring is driven entirely by software, with no meaningful human review, that is likely to be unlawful under Article 22 UK GDPR.

2. HR and employment decisions

Automated screening of job applications, performance management tools that generate dismissal recommendations, or absence-tracking systems that trigger disciplinary action without human oversight all carry significant risk. The effect on employment is precisely the type of "significant effect" that engages the prohibition.

3. Credit, insurance and financial services

Automated underwriting, credit scoring, and insurance pricing models that produce binding outcomes for individuals without human review are a well-known risk area - but the Uber case is a reminder that the prohibition extends well beyond financial services into any sector where automated decisions carry material consequences.

4. Customer-facing decisions

Account closures, fraud flags, and access restrictions applied automatically - without any human checking the decision before it is implemented - may also engage Article 22 where they produce a significant effect on the individual concerned.

Note - this doesn't mean that these sorts of decisions cannot be automated, but there needs to be sufficient "meaningful" human involvement.

What should in-house lawyers watch out for (in automated decisions?)

In-house counsel at UK businesses should review their automated decision-making practices with the following questions firmly in mind:

1. Does the decision fall within Article 22 UK GDPR?

Article 22 is engaged where a decision: (i) is based solely on automated processing; (ii) involves personal data; and (iii) produces a legal or similarly significant effect on the individual. "Solely" is key. If there is a genuine human review that can change the outcome, the prohibition may not apply, but that review must be meaningful, not a rubber stamp.

2. Is there a lawful basis for the automated decision-making?

Even where Article 22 applies, automated decisions are permissible in limited circumstances — where necessary for the performance of a contract, authorised by law, or based on explicit consent. Businesses must identify and document the basis they rely upon.

3. Are individuals being properly informed?

Privacy notices must explain that automated decision-making is taking place, the logic involved, and the likely consequences. The Uber case is a reminder that vague or incomplete disclosures will not satisfy the transparency obligations under Articles 13 and 14.

4. Is there a genuine right to contest?

Where automated decision-making is permissible, individuals must be given the right to obtain human review, to express their point of view, and to contest the decision. This must be a real and accessible remedy, not merely a theoretical one buried in terms and conditions.

5. Have Data Protection Impact Assessments (DPIAs) been carried out? 

Automated decision-making that produces significant effects on individuals is likely to require a DPIA under Article 35 UK GDPR. In-house counsel should ensure DPIAs are in place, kept up to date, and genuinely reflect how the system operates in practice, not just how it was designed to operate.

6. Is the human review meaningful?

This is perhaps the most critical question. Businesses often believe they have human oversight simply because a person is notified of a decision or has the ability to override it. That is not enough. The Uber case illustrates that where the human reviewer has no real ability or incentive to intervene, or where the system is structured to make override practically difficult, regulators will treat the decision as solely automated.

7. Are you monitoring for drift? 

Automated systems can change over time, through retraining, updates, or accumulation of data. In-house teams should ensure there are governance processes in place to keep DPIAs and internal records current, and to flag when changes to automated systems may alter the legal analysis.

The bottom line

The Uber fine is a landmark decision. It confirms that regulators will pursue significant enforcement action where automated systems are used to make life-altering decisions about individuals without any genuine human check. 

For UK in-house lawyers, AI Directors and others responsible for AI implementation the message is clear: audit your organisation's automated decision-making now, ensure transparency obligations are being met, and make certain that any human review in your processes is substantive rather than cosmetic. The ICO has shown an increasing appetite for enforcement in this space, and the Uber case will only sharpen its focus.