As reported by SecurityAffairs, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed an €825 million ($964M) GDPR fine on Uber for violating Article 22's prohibition on solely automated decision-making with significant effects on individuals. Between 2018 and 2022, Uber's software automatically suspended or permanently deactivated driver accounts based on fraud suspicion flags or low customer ratings—with no human review whatsoever.

Key Insight: As reported by SecurityAffairs, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed an €825 million ($964M) GDPR fine on Uber for violating Article 22's prohibition on solely automated decision-making with significant effects on individuals.

This is not just another privacy fine. It is the most significant enforcement of GDPR Article 22 to date, and it establishes a compliance baseline that extends far beyond the gig economy.

Why This Fine Matters More Than the Number

Article 22 has been described as GDPR's "sleeping giant"—a provision with enormous implications that regulators rarely enforced in the early years of GDPR. That sleep is over. The Dutch DPA's action confirms that regulators will treat automated decisions affecting someone's livelihood as among the most serious GDPR violations, comparable to unlawful data transfers and massive breaches.

The fine covers practices Uber says it has already discontinued, which raises the stakes further: regulators are willing to penalize historical automated decision-making even after companies change their systems. Retroactive exposure is real.

Who Is Now in the Crosshairs

Any organization using automated systems to make decisions that significantly affect individuals—employment status, account access, credit eligibility, fraud determinations, service termination—faces direct exposure under this enforcement precedent. That includes:

Why This Fine Matters More Than the Number
Gig economy and platform companies using algorithmic deactivation, rating-based terminations, or automated fraud flags
Financial institutions with automated account closures, credit denials, or transaction blocking without human review
HR and recruitment platforms using algorithmic screening, rejection, or performance management
E-commerce and SaaS providers with automated account suspensions based on behavioral signals
Insurance providers using automated claims denials or policy terminations

The EU AI Act, which entered full enforcement scope in 2026, compounds this risk. Employment and worker management AI systems are classified as high-risk under the AI Act, meaning they face conformity assessments, transparency obligations, and human oversight requirements that layer on top of GDPR Article 22.

The Transparency Failure Is Separate and Important

The Dutch DPA also found that Uber failed to inform drivers when automated systems made decisions about them. This is a distinct violation under Articles 13–15, which require organizations to disclose the existence of automated decision-making and provide meaningful information about the logic involved.

Many companies have automated decision systems they have never disclosed to affected individuals. That non-disclosure is itself a violation—separate from whether the decision was correct.

Shield53 Recommendations

  • Conduct an automated decision inventory: Map every system that makes or significantly influences decisions about individuals without meaningful human intervention. Include vendor-built and internally developed systems.
  • Implement human-in-the-loop for significant decisions: Any automated decision affecting employment, income, account access, or service eligibility must include documented human review before action is taken. "Meaningful" review means a person with authority to override the system.
  • Audit transparency disclosures: Verify that privacy notices and individual communications explicitly disclose automated decision-making and describe its logic in accessible terms. Remove vague language like "we may use automated tools."
  • Review historical exposure: Assess whether your organization operated solely automated decision systems in prior years. Document remediation steps and preserve evidence of when human review was added.
  • Align with EU AI Act requirements: For systems classified as high-risk under the AI Act, ensure conformity assessments, risk management documentation, and human oversight controls are in place. GDPR compliance alone is no longer sufficient.
  • Establish an algorithmic governance committee: Assign clear ownership for automated decision systems across legal, privacy, security, and business functions. Review quarterly and log all changes.

The message from the Dutch DPA is unambiguous: when an algorithm can take away someone's ability to earn a living, a human must be accountable. Organizations that treat automated decision-making as a purely operational efficiency play are now carrying regulatory liability they may not fully appreciate.