Legal news

  1. Accueil
  2. News
  3. Legal news
  4. A New Sanction Against Uber Based on Aut...

A New Sanction Against Uber Based on Automated Decision-Making

In 2020, the Human Rights League filed a class-action complaint with the CNIL on behalf of 170 Uber drivers. The company comprises UBER B.V., headquartered in Amsterdam, and UBER TECHNOLOGIES INC., based in San Francisco, U.S. Under the one-stop-shop mechanism, the Dutch Data Protection Authority (AP) handled the complaint in close cooperation with the CNIL.

As part of this proceeding, the AP has already imposed two penalties on Uber :

  • The first was a fine of 10 million euros for failing to provide drivers with information and to ensure they could exercise their rights, imposed on December 11, 2023 [1] ;
  • The second, dated July 22, 2024, is a fine of 290 million euros for transferring personal data outside the European Union—in this case, to U.S. servers—without sufficient data protection safeguards [2] .

This is therefore the third penalty imposed on Uber. It is the heaviest fine to date, totaling 824.99 million euros, and cites a violation of Article 22 of the GDPR due to automated decision-making against drivers without human intervention. Indeed, Article 22 states that « The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her ».

The DPA condemns both the temporary deactivation of Uber drivers’ accounts in cases of suspected fraud and the permanent deactivation of accounts following poor customer ratings. These decisions are automated and rely solely on customer ratings and comments ; they therefore involve no human review by the company. The AP also criticizes the company for failing to sufficiently inform drivers of the automated decisions made against them. The Data Protection Authority specifies that, although it is possible for Uber to conduct a human review of these decisions, such intervention must be effective and capable of altering the outcome of the decision, which was not the case here.

This analysis is based on the reasoning of the CJEU in its 2023 SCHUFA judgment (Case C-634/21) [3], which expands on the definition of automated decisions by drawing on Article 22 of the GDPR. The CJEU explains that it is not sufficient to characterize the system as one that assists human decision-making. It is necessary to verify whether the data subject has the actual possibility of seeking the intervention of a human being when decisions concerning them are made, in particular to exercise their right to object.

UBER has appealed the decision, which it considers too severe because it is based on practices that had reportedly been modified by the time of the ruling. The case is therefore not yet final.