The Library Media — Science, Technology & Health · AI News & Intelligence Desk
The Human Has to Be Able to Say No: What Uber’s €825 Million Fine Decided About Automated Decisions
By Eleanor Ever Loyal
Photo: Dllu / Wikimedia Commons (CC BY-SA 4.0)
The Dutch data protection authority’s €824.99 million fine against Uber was announced on August 21, 2026. It was not a new decision when it began circulating again this week. The ruling is worth examining now not because its date has changed, but because of what it establishes about the limits of automated decisions that affect people’s livelihoods.
The Autoriteit Persoonsgegevens, the Netherlands’ data protection authority, imposed the penalty after finding that Uber had suspended and permanently deactivated drivers through automated systems without meaningful human review. The authority led the case because Uber’s European operations are based in the Netherlands.
The fine is about $960 million. It is the second-largest penalty ever imposed under the General Data Protection Regulation, behind Meta’s €1.2 billion fine in 2023, and the largest ever imposed for automated decision-making. The authority said the penalty represented roughly 1.85 percent of Uber’s global turnover, which it put at about €44.5 billion.
The conduct at issue took place between 2018 and 2022. Uber’s systems assessed drivers for suspected fraud and persistently low ratings, then suspended or permanently deactivated accounts. The decisions were taken by software alone, according to the authority’s findings. Drivers could lose their livelihoods without a person meaningfully examining the circumstances of their cases.
That distinction is the heart of the ruling. Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing when that decision significantly affects them. The Dutch authority found that Uber’s process violated that protection.
The legal question was not simply whether a human being appeared somewhere in the process. It was whether that person could genuinely review the decision and change its outcome. The authority found that any human involvement did not amount to meaningful review because the human reviewer could not genuinely reverse what the system had decided.
In practical terms, a person who can only confirm a machine’s conclusion is not exercising meaningful oversight. The human presence may be visible in the workflow, but it does not provide the protection Article 22 is intended to secure. The test is whether the affected person has access to a reviewer with real authority to say no.
The case began with 171 French drivers. Their complaint was brought with the Ligue des droits de l’Homme and forwarded through France’s data protection regulator under the GDPR’s cross-border cooperation mechanism. The Dutch authority ultimately handled the case because of the location of Uber’s European operations.
The decision therefore grew out of individual complaints about drivers’ treatment, but its significance extends to the design of automated systems. Platforms use scores and assessments to make consequential decisions about access to work and services. Where a system disciplines, deactivates, demonetizes or dismisses people, the distinction between a genuine human review and a procedural checkpoint becomes central.
The ruling gives regulators a concrete standard to examine: not whether a human touched the file, but whether that person had the ability to reconsider the outcome. A platform cannot establish meaningful oversight merely by inserting a nominal reviewer into a process if that reviewer lacks the authority to change the machine’s decision.
That does not mean the ruling automatically resolves every dispute involving algorithmic management. Its reach comes through the GDPR, and it is not a worldwide judgment binding every platform in every jurisdiction. But companies operating within the regulation’s reach now have a significant enforcement decision to consider when designing systems that make consequential decisions about individuals.
There is also an important qualification: the case is not necessarily over. Uber has said it will appeal. The appeal remains pending, so the decision’s eventual legal trajectory has not yet been established. The Dutch authority says the violations have stopped.
The appeal will be important because it will test the authority’s findings and the application of Article 22 to the systems at issue. Until that process is resolved, the ruling should be understood as a major regulatory decision, not as a final worldwide rule governing every automated decision.
Its central proposition, however, is clear. Human oversight must mean more than human presence. If a person cannot meaningfully reconsider a decision that significantly affects someone, the review is not a safeguard in substance. Article 22’s practical test is whether the human has the authority to say no.
Eleanor Ever Loyal
AI News & Intelligence Desk, The Library Media
From The Library — the estate of our family.
