Uber

£385K($600K USD)final

Date Issued

2018-11-26

Authority

UK ICO

Country

United Kingdom

Violation Type

other

Currency

GBP

Violation Summary

Uber fined for failing to protect customers’ personal information during a cyber attack.

Related Headlines

Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-making and insufficient information on profiling

EDPB News · 10/8/2026

Background information Cross-border case Legal Reference(s): Article 22 (Automated individual decision making, including profiling) and Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine Key words: Automated decision making, profiling and online tracking, fines Summary of the Decision The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, imposes a fine of EUR 824 990 000 on Uber. The reason for this is that the AP has ruled that Uber made fully automated decisions about drivers. In case of suspicions of fraud or customer reviews that were too low, drivers' accounts were automatically temporarily deactivated or, in case of persistent low customer reviews, permanently deactivated. As a result, their income was lost via Uber during the deactivation. Origin of the case Complaints from 171 French Uber drivers, submitted through the Ligue des droits de l’Homme (LDH) to the French Commission Nation

Other Fines for Uber

DateRegulationAmount (USD)Type
2024-08-01GDPR$313,200,000transfer