Dutch regulator fines Uber $966M for automating driver suspensions
The Dutch data protection authority has fined Uber €825m ($966m) for using automated systems to deactivate driver accounts without adequate human review or warning, marking the second-largest GDPR penalty ever. The case, triggered by a French complaint and handled in the Netherlands due to Uber's European headquarters, involved suspensions for suspected fraud and permanent deactivations for low ratings. Uber disputes the decision and will appeal, while the regulator insists a computer shouldn't make decisions with major consequences alone.
A computer should not make decisions on its own that have (such) major consequences.
- sajithdilshan
> Uber temporarily suspended accounts of some drivers who were suspected of fraud, including when its systems concluded drivers had taken unnecessary detours to inflate fares or accepted trips without intending to complete them
Regardless of how Uber did it, these kind of drivers should be removed from the platform. This happened to me more than once. It’s quite frustrating as an example you want to get to airport and a driver has accepted your request, but you can see in the app the vehicle doesn’t move. One time this happened for all requests on Uber when I wanted to go to airport early morning and had to switch to Bolt
- loeg
This is likely more than Uber's entire Netherlands annual revenue, I think.
- molf
So according to the regulator Uber automatically suspended driver accounts that were flagged in decision of fraud or due to low ratings. They also failed to inform drivers about the automated decision making.
Here is the statement from the Dutch data protection authority:
Uber made fully automated decisions regarding drivers. In cases of suspected fraud or excessively low customer ratings, driver accounts were automatically temporarily deactivated or, in the case of persistently low ratings, permanently deactivated. As a result, their income from Uber ceased during the deactivation period.
Uber thereby violated the ban on fully automated decision-making under the General Data Protection Regulation (GDPR). The AP also found that Uber failed to adequately inform drivers about the automated decision-making. Uber has since ceased the violations.
Reference to the law that was broken (GDPR): [2][3]
Article 22.1: The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
Article 13.2f: In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing: [...] the existence of automated decision-making, including profiling, referred […]
- SpicyLemonZest
We’ve gotta normalize linking to the underlying ruling. Uber says they didn’t automate any permanent suspensions and the regulator says they did; how can anyone interpret this story without more information on how the regulator determined this?
- amazingamazing
I am curious, if the algorithm provided the recommendation and a person had to say agree or disagree for each would that be against the law?
Uber may want to reconsider operating in the Netherlands- would be surprised if they get this much in profit from this region. Unfortunately for them these laws are EU wide.