Uber's 825 million euro lesson: the missing human is the violation

Two trigger conditions did the work here, and both are ordinary plumbing: software watching driving behaviour that raised a fraud suspicion, and a customer rating that fell under a threshold ^[4]. The first took an account off temporarily; persistent low ratings took it off for good, and the driver's earnings through the platform stopped while the account was down ^[3]. Nothing in the regulator's description requires the model to have been wrong. The GDPR's limit attaches to fully automated decisions that can significantly affect a person's life, and taking away the ability to earn sits inside that ^[18], so the absence of a human assessment is itself the finding ^[5].

That makes the defensible artefact a record rather than a policy. Uber disagrees with both the decision and the amount and is appealing ^[8]. Its position is that the authority examined historic policies discontinued years ago, and that it has human reviews, robust safeguards and an appeal route for drivers who believe it made a mistake ^[9]. The AP's own statement says the violations have now stopped ^[7]. Those two readings can both hold only if the human step arrived after the conduct window closed, and securityaffairs notes the appeal will have to establish whether the protections existed during 2018 to 2022 or came later ^[10]. A present-tense appeals process is not evidence about a 2019 deactivation. Proving the point after the fact means producing dated evidence, decision by decision, that a person looked and had the authority to reverse the call. The transparency finding is the cheap half to remedy; the review requirement is the half that shows up in headcount.

The size is worth reading against this regulator's own history with the company. The prior record was 290 million euros in 2024, over European driver data sent to the United States without adequate protection ^[12], which Uber also appealed at the time ^[13]. The new penalty is roughly 2.8 times that ^[15], and the two together put about 1.1 billion euros in front of a single national authority ^[16].

The transferable part is the shape, not the industry. A score crosses a line, an account changes state, and nobody in the loop is asked to agree ^[4]. Fraud holds and abuse enforcement are usually built that way, and the AP did not have to argue that any individual outcome was unfair to reach a penalty ^[5]. For anyone running that pattern on EU data subjects, the question on the table is not model accuracy but whether a review step exists, who staffs it, and whether its output is logged well enough to survive a regulator reading it four years later.