GDPR Automated Decision-Making: What Uber's Fine Teaches You
The Dutch Data Protection Authority (AP) fined Uber €825 million for breaching GDPR rules on automated decision-making. Uber deactivated driver accounts automatically via algorithms, without meaningful human review. The AP holds that this is exactly what the law prohibits. What does this mean for your business or platform working with freelancers?
Not legal advice. Consult a qualified legal adviser for your specific situation.
What Is GDPR Automated Decision-Making — and Where Did Uber Go Wrong?
Article 22 of the GDPR prohibits decisions based solely on automated processing that significantly affect a person legally or otherwise. Uber automatically suspended or permanently deactivated driver accounts on suspicion of fraud or persistently low ratings. The result: immediate loss of income for freelancers, with no human reviewing the decision.
The AP ruled that Uber violated Article 22. Uber contests the findings, arguing that final deactivations were never fully automated — but the regulator disagrees.
This follows an earlier Uber fine of €290 million for transferring European driver data to the US. The new penalty is more than 2.8 times higher, a clear signal that repeat violations are treated very seriously by the AP.
| Situation | Permitted under GDPR Art. 22? |
|---|---|
| Algorithm flags risk → human makes decision | ✅ Yes |
| Algorithm blocks account automatically without review | ❌ No |
| Automated decision with explicit consent + right to human review | ✅ Yes |
| Scoring system affecting income with no right to object | ❌ No |
What Does the Law Actually Require?
According to the AP, Article 22 gives individuals the right not to be subject to a solely automated decision that significantly affects them. Three exceptions apply: consent, a legal basis, or necessity for a contract. Even then, the AP states that the individual must have the right to meaningful human intervention, to express their view, and to contest the decision.
For your GDPR obligations around processing personal data, including time tracking and location data, see our knowledge base on GDPR & Time Tracking: Legal Basis, Location Data.
What Does This Mean for Platforms Working with Freelancers?
Suppose you run a platform or internal tool that schedules freelancers, rates their performance, or renews contracts. If your system automatically blocks access or terminates contracts based on scores, you are operating in the same space as the situation at issue in the Uber case.
The AP has made clear that Article 22 applies broadly. Not just large platforms fall within scope. Smaller software systems that automatically assess, block, or terminate freelancer accounts based on algorithms are equally covered.
Three practical steps to reduce your risk:
- Map your automated processes. Which decisions does your software make without human involvement? Think: access rights, scores, blocks, renewals.
- Build in a review step. Ensure a responsible employee explicitly confirms every significant decision before it is executed.
- Inform those affected. Freelancers must know they can challenge a decision and that a human makes the final call.
For broader guidance on using AI tools compliantly in your business, see our knowledge base on AI Tools & Project Privacy: What SMEs Must Know and GDPR & Generative AI: What Freelancers Must Know.
Get your time tracking in order today with a platform that puts transparency and human oversight first.
How to Keep Your Own Software GDPR-Compliant
If you use an all-in-one platform like PrikKlokPlus for time tracking, project management, and invoicing, decisions on hours, leave, and expenses are supported — but never executed automatically. A manager or business owner approves or rejects. That is the human intervention the AP requires under Article 22 of the GDPR.
Transparency towards your employees and freelancers matters equally. Document:
- What data you collect and why
- How long you retain it
- Who makes the final decision
Conclusion
The €825 million Uber fine is not an isolated incident. It is a policy statement by the AP. According to the AP, automated decisions that affect freelancers' income or access fall under Article 22 of the GDPR. Human intervention is a requirement that the regulator actively enforces, not an optional addition. Review your own processes, build in approval steps, and keep affected parties informed of their rights.
Not legal advice. Consult a qualified legal adviser for your specific situation.
Frequently Asked Questions
What is automated decision-making under the GDPR? A decision made solely by an algorithm or system, without human review, that significantly affects someone legally or otherwise, such as blocking an account or terminating a contract.
Does Article 22 apply to small platforms and SMEs? The AP has indicated the scope is broad. Even smaller software systems that automatically assess or block freelancer accounts can fall under Article 22, regardless of organisational size. Consult a legal adviser for your specific situation.
Can I use algorithms to assess freelancers at all? Yes, as a support tool. The problem arises only when an algorithm independently makes a significant decision without human involvement. Always ensure a responsible person makes the final call and document this.
What should I do if my platform automatically scores freelancers? Map which decisions are triggered by those scores. Build a mandatory review step into every significant decision, inform freelancers of their rights, and record the procedure in your data processing register.
Get Started
Work transparently and compliantly with your freelancers. PrikKlokPlus supports your processes without replacing your people.