Uber turned access to work into a software output.
The Dutch Data Protection Authority found that Uber’s historic systems could temporarily block drivers flagged for suspected fraud and temporarily or permanently deactivate drivers because of low customer ratings. France’s privacy regulator, CNIL, said the decisions involved a “complete absence of human intervention”. Once the block landed, a driver could no longer accept rides or earn through Uber.
That finding brought an administrative fine of €824,990,000 against Uber B.V. and Uber Technologies Inc.. Uber told the Associated Press that the policies are old, its current systems include human review and appeals, and it will challenge the decision. Those claims deserve to be heard. The system described by the regulator remains indefensible.
Software can flag a suspicious trip. It should never get the final word on whether a person loses access to income.
A fraud flag became an income cutoff
The investigation began with a 2020 complaint from the French human rights organization Ligue des droits de l’Homme on behalf of more than 170 drivers. The Dutch authority took the lead because Uber’s main European establishment is in the Netherlands.
The public record describes two routes to deactivation. Uber monitored operational data and customer ratings. Reuters reported that fraud triggers included systems concluding a driver took an unnecessary detour to increase a fare or accepted a trip without intending to complete it. A fraud flag could produce a temporary block. Low ratings could lead to temporary or permanent deactivation, according to the regulators.
The regulator’s public account describes conduct from 2018 through 2022. Reuters’ account of the underlying decision describes incidents from 2020 through 2022. The complete decision was not available through the regulator’s public page when I checked, so that discrepancy should stay visible.
The consequence is the same under either date range. Uber controls the app that connects drivers to customers. When Uber closes an account, the driver loses the ability to earn on the platform at once. Any unexplained loss of income this severe demands a fair process, whatever label the company puts on the work relationship.
Fraud control needs speed and judgment
Uber has a serious counterargument. A ride platform has to respond quickly to fraud, identity misuse, dangerous conduct, fake trips, and manipulated fares. Waiting days for a manual investigation before taking any protective action could leave passengers at risk and let fraud continue. At Uber’s scale, software has to sort signals and identify cases that deserve attention.
The company also disputes the regulator’s account. Uber told Reuters that it did not permanently deactivate suspected fraud accounts without human review. Uber says the fine concerns policies discontinued years ago and that current systems include safeguards, human review, and a way for drivers to contest decisions.
Software can triage cases at scale. The final decision still belongs to a responsible person. Uber could briefly pause an account when a credible safety or fraud signal demands immediate action, then place the evidence before a qualified reviewer. That reviewer needs to see the relevant trip data, hear the driver’s explanation, and have the authority to restore access. A generic appeal form that routes back to the same conclusion would be theater.
Courts have already seen both versions of Uber’s process. In a 2021 Amsterdam case involving four drivers, Uber said two employees on its risk team had to agree before deactivation. The court accepted that account for those cases, although it still ordered disclosure of data behind two decisions. In separate cases two years later, the Amsterdam Court of Appeal found that important Uber and Ola decisions were fully automated and materially affected drivers’ income.
Meaningful review depends on whether the person actually investigates and can overrule the software.
Human review has to be able to change the result
Europe wrote that principle into law. Article 22 of the General Data Protection Regulation protects people from decisions based solely on automated processing when those decisions create legal effects or similarly significant consequences. Where an exception applies, the regulation requires safeguards that include human intervention, a chance to express a point of view, and a right to contest the decision.
European data protection guidance makes clear that a decorative reviewer is not enough. The privacy guidance endorsed by the European Data Protection Board says human involvement must be meaningful and performed by someone with the authority and competence to change the outcome. A person who rubber stamps a score does not turn an automated decision into a human one.
Uber should not have to publish fraud rules in enough detail to help people evade them. Drivers still need an intelligible explanation, including the specific allegation and evidence relevant to their case. The European Union’s top court has said that meaningful information requires an explanation of the procedure and principles actually applied, rather than a complex formula or an algorithm dump.
The 2023 Amsterdam appeal reached the same practical balance. The court required information that drivers needed to understand important automated decisions and rejected Uber’s blanket trade secret objection. A company can protect genuine security details while telling a worker why it cut off the worker’s income. Uber has to explain enough for a driver to contest the result.
Uber owns the decision
Uber has appealed the regulator’s finding, and the authority says the violations ended. This is an administrative decision under challenge, not a final judicial judgment. A serious argument has to distinguish the historic system described by the regulator from Uber’s claims about its current process.
A later policy change cannot erase years of automated deactivations. Uber built a business around controlling access to customers while shifting employment risk onto drivers. Then, according to the Dutch authority, it let software exercise one of management’s harshest powers without a manager making the call.
Software may flag a case and briefly pause access when immediate safety requires it. Any consequential suspension must reach a human who can inspect the evidence, hear the worker, and reverse the result. The company that controls the app remains responsible for the decision. “The algorithm did it” is not a labor policy.