You wake up, open your app, and it’s gone. Your livelihood, your status, your access—wiped out by an invisible line of code. No human spoke to you. No one explained why.
This nightmare became the reality for thousands of Uber drivers across Europe between 2020 and 2022. Now, the Dutch Data Protection Authority has finally hammered the company with an €825 million fine for its reliance on automated systems to deactivate driver accounts.
This isn't just about ride-sharing. It’s a massive signal that the era of "computer says no" is hitting a wall of regulation. If you’re building or managing a business that relies on algorithms to make high-stakes decisions, you need to pay attention.
The algorithmic black box
The core issue here is what the General Data Protection Regulation (GDPR) calls "automated decision-making." Under Article 22, companies are effectively barred from making decisions that have a "significant impact" on people's lives—like losing your job—without meaningful human intervention.
Uber didn't just automate a minor preference; they automated the ability to earn a living. The regulator found that the company used algorithms to suspend drivers suspected of fraud or low ratings without a human checking the evidence.
Basically, the software acted as judge, jury, and executioner.
Most people assume these systems are "smart," but they’re often just rigid. They flag patterns. If a driver takes a weird route or gets a couple of bad ratings, the system might trigger an automatic lockout. When you scale that to millions of users, the error rate matters. A one percent failure rate looks great on a spreadsheet until you realize that "one percent" represents thousands of families suddenly unable to pay rent.
Why this hit Uber so hard
Uber argues that it has changed its ways. They claim these policies are "historic" and have been discontinued. But the fine, the second-largest in the history of GDPR, suggests the regulators aren't buying the "it’s in the past" excuse.
The sheer size of the penalty—€825 million—is meant to hurt. It’s meant to be a deterrent.
What the competitor article glossed over is the chain reaction that led here. This started with a complaint from French drivers. Because Uber’s European headquarters are in Amsterdam, the Dutch regulator took the lead, but they collaborated with the French authorities. This "one-stop-shop" approach within the EU means you can’t just hide in a jurisdiction that feels "business-friendly" if your actions impact people across the continent.
The human in the loop requirement
If you are running a platform, you cannot hide behind an API. You need to design for friction.
- Transparency isn't optional. You must tell users when a decision is automated. Not in a 40-page terms of service agreement, but in clear, plain language.
- Meaningful human review. This doesn't mean a human just clicks "approve" on an automated recommendation. It means a person has to actually look at the data, verify the context, and have the power to overturn the algorithm.
- The right to appeal. If a user feels wronged, they need a path to contest that decision that doesn't involve shouting into a support ticket void.
The bigger picture for 2026
We’re seeing a shift in how regulators view "tech-native" companies. For years, these firms moved fast and broke things because the law couldn't keep up with the code. That gap is closing.
When you build a product, ask yourself these three questions:
- If this algorithm gets it wrong, how much pain does it cause the user?
- If it gets it wrong, can the user talk to a human in under an hour?
- Does our system allow for a human to override the machine in real-time?
If you can’t answer yes to all three, you’re just waiting for your own regulatory storm. The Dutch fine is an expensive reminder that convenience never trumps the legal rights of the people using your platform.
Don't wait for a nine-figure penalty to audit your processes. Take a hard look at your automated systems today. If your users are at the mercy of a black box, it’s time to add a human layer before the regulators do it for you.
The days of letting the software run the show without guardrails are over.
