Time Tracking Automation & Employment Law: What Uber's Fine Teaches You
The Dutch Data Protection Authority (AP) fined Uber nearly €825 million for automatically suspending drivers without meaningful human oversight. If your software automatically assesses, scores, or restricts employees or freelancers based on logged hours or behaviour, this ruling applies to you directly.
Not legal advice — consult a qualified privacy or employment law specialist for your specific situation.
What Went Wrong at Uber?
Between 2018 and 2022, Uber suspended and blocked drivers via algorithms, based on fraud suspicions or low ratings, without adequately informing them. There was no meaningful human involvement: an algorithm decided, an account disappeared. The AP ruled that Uber had systematically violated GDPR Article 22: the right of individuals to human intervention in automated decisions that significantly affect them.
The official AP announcement makes clear this was a pattern, not an incident. The precedent is set: platforms and software embedding similar functionality, including smaller players, fall under the same GDPR framework.
Where Is the Line With Time Tracking Automation?
Imagine you run a small business with five employees and a freelancer. Your time tracking software detects that the freelancer consistently logs fewer hours than agreed and automatically blocks their project access. No notification, no conversation, no human review: the system acts.
This is precisely the scenario the AP found problematic in the Uber case. The core question is:
Does your software make a decision that affects someone's legal position or access to work, without a human consciously making and communicating that decision?
If the answer is yes, you have a GDPR risk.
| Situation | GDPR Risk | What to Do |
|---|---|---|
| Automatic reminder for missing hours | Low | No special measures needed |
| Automatic report to manager | Low | Inform staff in privacy policy |
| Automatic project access block | High | Human intervention required per AP guidance |
| Automatic performance score | High | Transparency and right to object |
| Automatic termination of access/contract | Very High | Human decision and duty to inform |
Get your time tracking in order with a tool built on transparency and human oversight: explore time tracking tips for freelancers.
What GDPR Concretely Requires
According to GDPR Article 22 and the AP's guidance, the protections apply whenever an automated decision has legal consequences for a person or otherwise significantly affects them. The AP states this creates three practical obligations:
1. Transparency Inform employees and freelancers in plain language about what data you collect, how it is used, and whether automated assessments take place. Document this in a privacy statement or data processing agreement. Read more in our knowledge base article on GDPR & time tracking: legal basis, location data and retention periods.
2. Human Intervention Automated signals must never lead to significant decisions without a person consciously making that call. Let your software generate alerts and reports; let you or your manager take the actual decision.
3. Right to Object Individuals must be able to challenge automated decisions. Document how they can do so and who is responsible for the review. See also our GDPR templates for SMEs 2026 to get compliant quickly.
Practical Steps: Set Up Your Software Responsibly
- Configure alerts, not automatic actions. Let the system warn you when hours are missing, then act yourself.
- Document your processing activities. What personal data do you store, for how long, and for what purpose? This belongs in your processing register.
- Inform everyone upfront. Send new employees and freelancers a clear privacy statement before they start.
- Build a simple objection procedure. One point of contact, one clear process, even if your business has three people.
- Audit your software supplier. Do you have a data processing agreement? Do you know which algorithms your platform uses and what outputs they generate?
Wondering how AI tools in project management handle privacy? Read our article on AI tools & project privacy: what SMEs must know.
Conclusion
Uber's €825 million fine is not a warning reserved for big tech. It is a signal to anyone using software where algorithms make decisions about people and their work. Time tracking and automation are valuable, provided you keep a human in the decision-making loop, are transparent about what you measure, and give individuals a voice. Do that, and you reduce GDPR risk while building a fairer working environment.
Frequently Asked Questions
Does GDPR Article 22 apply to small businesses? According to the text of the GDPR and the AP's guidance, the regulation makes no distinction based on company size. The AP states that as soon as software makes automated decisions that significantly affect someone's legal position or work, transparency and intervention obligations apply in full. The size of any potential fine may reflect turnover, but the obligation itself does not.
My time tracking software generates automatic reports. Is that already a problem? Generating a report is not in itself an automated decision under GDPR Article 22. It becomes problematic when that report automatically triggers an action, such as blocking access, withholding payment, or ending a contract, without a human consciously making that decision.
How do I inform freelancers about automated processing? Add a clear paragraph to your data processing agreement or privacy statement describing which data you collect (hours, location, performance indicators), how it is used, and whether automated signals or scores are generated. Also state who the point of contact is for questions or objections.
What if my software supplier builds in algorithms I am not aware of? As the data controller, you remain liable for what happens to the personal data of your employees or freelancers. Ask your supplier for a clear description of all automated functions and formalise agreements in a data processing agreement.
Take the first step towards GDPR-compliant time tracking today
PrikKlokPlus combines transparent time registration with human oversight: no hidden algorithms, no automatic actions without your approval.