Automated decisions: what does Uber's EUR 825 million fine mean for Norwegian companies?

Picture a food courier opening the app before the evening shift and being told the account has been deactivated. Nobody has called, and nobody can explain why. The system has picked up something it reads as fraud, and from that moment the income is gone. In practice, this is what Uber has now been fined EUR 824,990,000 for.

What was Uber fined for?

The Dutch data protection authority, Autoriteit Persoonsgegevens (AP), found that Uber took fully automated decisions about drivers between 2018 and 2022. Software monitored driving patterns and customer ratings. Where fraud was suspected or ratings were too low, the account was deactivated automatically, either temporarily or, in the case of persistently low ratings, permanently. No human assessment took place before the driver lost their income.

AP found infringements of the prohibition on fully automated decisions in GDPR Art. 22 and of the duty to inform in GDPR Art. 13, because drivers were not given sufficient information about the automated decisions and the profiling. According to the authority, Uber has stopped the practice.

The case began when 171 French drivers turned to the human rights organisation Ligue des droits de l’Homme, which complained to the French data protection authority CNIL. Because Uber’s European headquarters is in the Netherlands, the case was handled by AP under the one-stop-shop mechanism in the General Data Protection Regulation. AP states that the fine was coordinated with the other European supervisory authorities. The authority published the case on 21 August 2026, and the EDPB reported on it on 8 October.

Has Uber appealed the fine?

Yes. Uber has appealed, and there is no final court ruling. The fine is therefore not final, and the amount may be reduced or set aside.

Nor is this the first time AP and Uber have met. This is the fourth fine the authority has imposed on the company, and Uber is still challenging the previous two.

When are automated decisions prohibited under GDPR Art. 22?

Automated decisions are prohibited when three conditions are met. The decision is based solely on automated processing, it concerns an individual, and it produces legal effects for that person or similarly significantly affects them. The rule applies in Norway through Personal Data Act § 1, which incorporates the Regulation into Norwegian law. Several of the basic rules are gathered on our data protection topic page.

In practice the threshold is met by decisions such as refusing a loan, closing a customer account that the business depends on, or automatically sorting job applicants.

The prohibition reaches further than many assume. In C-634/21 SCHUFA the Court of Justice held that the credit score itself may be an automated decision where the bank relies heavily on it. It is of little help that a human formally “decides” the case if that person in reality just follows the figure the system produces.

A human who simply clicks “approve” on the system’s recommendation does not make the decision any less automated.

What exceptions are there?

GDPR Art. 22(2) allows automated decisions in three situations. The decision may be necessary for entering into or performing a contract, it may be authorised by law, or the data subject may have given explicit consent.

Even where an exception applies, GDPR Art. 22(3) requires that the data subject has the right to obtain human intervention, to express their point of view and to contest the decision. The Uber drivers received no human assessment before their accounts were closed. It is hard to see how any exception could have saved the arrangement without exactly that.

What must the business tell people?

The business must disclose that it uses automated decisions, provide meaningful information about the logic involved and explain the possible consequences of the decision. The requirement follows from GDPR Art. 13(2)(f) where the data is collected from the person, and from GDPR Art. 14(2)(g) otherwise. The data subject can also request the same information through an access request under GDPR Art. 15(1)(h).

In C-203/22 Dun & Bradstreet Austria the Court of Justice clarified that the explanation must make it possible to understand how the decision was reached. That does not mean the algorithm has to be handed over. Nor are trade secrets a reason to refuse any explanation at all. We have written more about deadlines and exceptions in our article on subject access requests.

How large can fines for automated decisions be?

Infringements of Art. 22 and of the duty to inform can lead to a fine of up to EUR 20 million or 4 per cent of the group’s worldwide annual turnover, whichever is higher, under GDPR Art. 83(5). AP states that Uber had worldwide turnover of around EUR 44.5 billion in 2025. The fine is therefore just under 2 per cent, or less than half the maximum.

For a Norwegian business with a turnover of NOK 500 million, the turnover-based cap is lower than EUR 20 million. The cap is then EUR 20 million. For most businesses, an order to stop an automated process that operations are built around is at least as costly as the fine.

Does this only apply to platform companies?

No. Art. 22 protects all data subjects, whether they are employees, contractors, customers or job applicants. The decision applies just as much to a bank that closes accounts on suspicion of money laundering, a marketplace that bans sellers, or an employer that lets a system decide who gets shifts.

Platform work is also subject to special rules. The Platform Work Directive (EU) 2024/2831 must be implemented in the EU by 2 December 2026 and requires, among other things, that decisions to restrict, suspend or terminate an account are taken by a human. Whether and when the Directive will be incorporated into the EEA Agreement has not been settled. For employees, the rules on control measures in Chapter 9 of the Norwegian Working Environment Act (arbeidsmiljøloven) also apply, as does the duty to discuss the use of AI with employee representatives, which we have covered in our article on the AI agreement in Norwegian working life.

What should the business do now?

Start by mapping where systems currently close, reject, prioritise or rank people without a human stepping into the case. Many such processes are hidden in fraud filters, credit checks and rules engines that were set up before anyone thought about data protection.

1. Decide for each process whether the decision has significant effects on the person. If it does, you need either an exception under Art. 22(2) or a genuine human assessment before the decision takes effect.
2. Give the person reviewing the case time, access to the underlying data and authority to overrule the system. Log how often the system’s recommendation is changed. If it is never changed, the review is probably not genuine.
3. Carry out a DPIA. GDPR Art. 35(3)(a) requires one for systematic and extensive evaluation of individuals on which decisions are based. See our review of DPIA for AI tools.
4. Write the privacy notice so that it explains which signals trigger action and what the person can do to have the case reviewed again.

The last point is the cheapest. Uber was also fined because drivers were not told how the system worked, and that infringement could have been avoided with an honest page in the privacy notice and a channel where drivers could talk to a human.

Questions and answers

Next legal review: 15 December 2026