The 825 million euro lesson: an automated suspension that stops earnings needs a human and an appeal

The rule the AP applied does not ask how good the model is. It asks what the output does to the person on the other end. GDPR bars decisions taken by algorithm alone where they significantly affect someone, and requires both meaningful human involvement and a route for the person to challenge the outcome ^[3]. For a driver, losing account access means losing the ability to work, which is why the regulator treated a suspension as something other than a change of account status ^[4]. The AP found Uber breached that right, and separately breached the right to be informed ^[7][8].

None of that turns on model quality. The flags described in the reporting are ordinary anti-fraud heuristics: journeys that looked like padded detours to inflate fares, and accepted trips the systems judged the driver never meant to complete ^[11]. The defect sits in what the system was allowed to do with a flag on its own, and in how little the driver was told when it acted.

Uber's own proportionality argument shows where that bites. The company said low customer ratings cost 126 drivers their accounts across Europe in 2021 ^[12], while the AP has published no total for how many drivers the automated suspensions touched ^[13]. Take Uber's figure at face value and the penalty works out to roughly 6.5 million euros per driver ^[17]. As compensation that is nonsense. As a signal it is precise: the duty runs per affected person, so a queue that can end 126 livelihoods carries the same review requirement as one that can end 126,000.

The duration defence runs into the same wall. Uber said the suspensions were usually brief and that it did not permanently deactivate accounts without human review ^[18]. Brief and unpaid is still unpaid, and the statutory test is the effect on the person, not the length of the outage ^[3]. Uber now says its policies include human review and a way for drivers to contest a suspension, and that it no longer permanently deactivates accounts through automation alone ^[9]. That is roughly the design the regulator wanted, arriving after the conduct window that closed in 2022 ^[20].

Then the price. The AP has now penalised Uber four times, at 600,000 euros in 2018, 10 million in early 2024, and 290 million for transfers of driver data to the United States ^[21]. This decision is close to three times that record and grew out of the same French complaints ^[10]; set against 2018, it is about 1,375 times larger ^[15]. The only bigger GDPR fine, Ireland's 1.2 billion euros against Meta, also came from a regulator in a small member state that hosts an American company's European headquarters ^[14], which is the same mechanism that put a complaint from French drivers in front of a Dutch authority ^[6].