Uber
Date Issued
Regulation
Authority
Country
Violation Type
Currency
Violation Summary
Uber fined for failing to protect customers’ personal information during a cyber attack.
Related Headlines
EDPB News · 10/8/2026
Background information Cross-border case Legal Reference(s): Article 22 (Automated individual decision making, including profiling) and Article 13 (Information to be provided where personal data are collected from the data subject) Decision: Administrative fine Key words: Automated decision making, profiling and online tracking, fines Summary of the Decision The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, imposes a fine of EUR 824 990 000 on Uber. The reason for this is that the AP has ruled that Uber made fully automated decisions about drivers. In case of suspicions of fraud or customer reviews that were too low, drivers' accounts were automatically temporarily deactivated or, in case of persistent low customer reviews, permanently deactivated. As a result, their income was lost via Uber during the deactivation. Origin of the case Complaints from 171 French Uber drivers, submitted through the Ligue des droits de l’Homme (LDH) to the French Commission Nation
Other Fines for Uber
| Date | Regulation | Amount (USD) | Type |
|---|---|---|---|
| 2024-08-01 | GDPR | $313,200,000 | transfer |