825 million euros is what the Dutch regulator charged for the human missing from Uber's ban loop

The flags themselves were ordinary fraud detection. Uber's systems concluded that some drivers had taken unnecessary detours to inflate fares, or had accepted trips they never intended to complete, and their accounts were temporarily suspended ^[6].

What the decision prices is the step that was absent after the flag. GDPR does not prohibit scoring drivers by machine; it prohibits a decision reached solely by machine where the impact on a person is significant, and requires both meaningful human review and a route to challenge the outcome ^[9]. Deputy chair Monique Verdier framed the harm in cash-flow terms, saying that from one moment to the next drivers had no income, and that a computer should not make decisions on its own with consequences of that size ^[8].

For scale, the only larger GDPR penalty is the 1.2 billion euros Ireland imposed on Meta in 2023 over unlawful transfers of European Facebook users' data to the United States ^[3], a fine the EDPB says followed a binding decision of the board ^[14] and which Meta is appealing ^[4]. Uber's 825 million is roughly 69 percent of that figure ^[12].

The subject matter is the part worth sitting with. The record holder concerns where data was sent. This one concerns the sequencing of an internal enforcement workflow: what the software was allowed to switch off on its own, and how long the driver waited for a person. That is a product decision, priced at 966 million dollars at the exchange rate in the report ^[1].