Uber's record €825M GDPR fine was forced by the drivers it suspended, and they're building a company to do it again

Uber's fourth Dutch fine: nearly €825 million, and the last three penalties add up to €1.125 billion

The Dutch Data Protection Authority has fined Uber €825 million (around $966 million) for deactivating driver accounts through an automated process without sufficient warning or human oversight, the second-largest penalty issued so far under Europe's General Data Protection Regulation, according to Reuters, behind only the €1.2 billion Ireland imposed on Meta in 2023 over Facebook users' data transfers 12. The regulator's news listing dates the public announcement August 21, 2026, and calls it a fine for "automated driver blocking" 3.

Paul-Olivier Dehaye, founder of PersonalData.io, a Swiss nonprofit focused on digital rights that helped the drivers build their case, says the €825 million follows a €290 million fine over Uber's handling of drivers' personal data and a €10 million fine stemming from related issues, and that all three originate with complaints made by the same group of drivers 2. Those three fines add up to €1.125 billion, a sum that is our desk arithmetic on the three fine amounts, not a figure any regulator has announced. The regulator counts differently: its own release calls this the fourth fine on Uber, after €600,000 in 2018 for a data breach, a penalty outside the drivers' complaint chain 4.

From 170 testimonies to €1.125 billion in seven years

The regulator's releases now date every step 32:

• 2019: Brahim Ben Ali, a former Uber driver in France, has his account deactivated. He collects testimonies from 170 other Uber drivers and brings his complaint to the Netherlands, where Uber's European headquarters are located 2. The regulator's file counts 171 French drivers reporting to the Ligue des droits de l'Homme, a one-driver gap the release does not explain 4.
• 2023: a €10 million fine, which Uber has objected to; Dehaye ties it to the same complaints, a link resting on his account alone 52.
• August 26, 2024: €290 million for transferring European drivers' personal data to the US without safeguards, in some cases criminal and medical data; the investigation opened on the same French complaint 5.
• August 21, 2026: the regulator announces €824,990,000 for fully automated deactivations that ran from 2018 to 2022, temporary for suspected fraud or low ratings, permanent for persistently low ratings, with income lost during deactivation; the regulator says Uber has now stopped the violations 4.
• Next: Dehaye plans a class action through which drivers can seek compensation 2.

Dehaye's summary of what one report can do: a driver "can complete a thousand journeys with satisfied passengers, but if just one person reports a very serious problem, the consequences can be enormous." 2 Seven years separate the 2019 deactivation from the €825 million decision, and the penalty works out to about €4.9 million per testimony in Ben Ali's original file of 170. Both figures are our arithmetic, offered as a measure of scale, not a payout.

The fine's sizing is public too. European fines cap at 4% of worldwide annual turnover, Uber's 2025 turnover was about €44.5 billion, so the ceiling sat near €1.78 billion and the penalty is about 1.85% of one year's revenue 4. The €290 million fine was about 0.84% of Uber's 2023 turnover of €34.5 billion 5: in our arithmetic, the intensity ratio on this complaint chain has more than doubled in two years.

Uber's defense supplies one number the regulator never published: it told Reuters the fine is disproportionate partly because only 126 drivers in Europe were deactivated over low ratings in 2021 1. That is about €6.5 million per driver in Uber's own framing; the regulator's 2018-2022 window and its fraud-suspension category make the true denominator not publicly computable.

Did a computer decide, or did the policy?

Deputy chair Monique Verdier said Uber had "committed serious infringements" and that drivers were "deactivated without pardon", losing their income from one moment to the next; her stated principle, per the release, is that decisions this weighty need a human looking at them first, not software deciding alone 4. Uber disputes the finding, has filed an appeal, and argues that most driver suspensions are brief, that drivers can appeal, and that it never automated permanent deactivation decisions; the regulator found that persistently low ratings produced exactly that 42.

The sharpest argument about this fine is not about Uber's conduct but about how to describe what happened. John Gruber of Daring Fireball worried the fine effectively makes it unlawful in the EU for Uber to police drivers who scam customers or strand riders by never showing up, and he rejected Verdier's framing: crediting "a computer" with these decisions is like crediting "the time clock" when a company fires a worker who is always late, because managers set the policies and the devices merely measure compliance 12.

Dehaye's answer, given to TechCrunch's Anthony Ha (who notes he has known Dehaye casually since college), is that Gruber "misses the point": Uber is free to use humans to punish drivers who scam, but then it has to take responsibility for that decision-making, "like 'being an employer', not 'being a marketplace'" 2. On our reading, the disagreement is about which costs Uber is being asked to carry: human review costs headcount, employer status costs obligations, and the Dutch DPA has now priced the third option, automation without review, at €825 million.

The playbook is becoming a product

Dehaye is starting a new company called StartClaims to support the litigation and other regulatory action, first against Uber, then expanding to other gig economy cases and related areas like adtech 2. The regulator's release documents what he is packaging: 171 drivers reported to the Ligue des droits de l'Homme, which lodged a complaint with France's CNIL, which passed the case to the Dutch regulator under the GDPR's one-stop-shop rule because Uber's European headquarters sit in the Netherlands, with the decision aligned across European supervisors 4. Complaint assembly, cross-border relay, jurisdiction by headquarters: each step is now a documented procedure rather than a volunteer improvisation.

That is the so-what for anyone shipping automated decisions with account-level stakes. The method that produced this fine was once a volunteer effort that happened to work: one complaint, a data file on how decisions were made, a regulator, then damages. It is now an accountability supply chain, and as of this month it has a company attached. Uber's appeal may move the €825 million figure, and it is still contesting the previous two fines 4; on our reading the appeal will not change the sequence that produced all three, and the sequence is the part other platforms can inherit.