A French Drivers’ Complaint Produced Dutch GDPR Fines of 290 Million and 825 Million Euros Against Uber

One complaint from French drivers produced three Dutch bills. The €290 million transfer penalty was the middle chapter. The €825 million chapter is about a computer cutting off a person’s income.

In 2020, France’s data-protection authority received a collective complaint from La Ligue des droits de l’Homme on behalf of more than 170 Uber drivers. The complaint, supplemented in 2021, covered three problems at once: what drivers were told about their data, transfers of that data out of the European Union, and automated decisions that temporarily or permanently disconnected people from the app. Under the GDPR’s one-stop shop, the Dutch Autoriteit Persoonsgegevens took the lead because Uber’s European establishment is in Amsterdam. The CNIL stayed in the file as a cooperating authority. L'Alleanza AEGIS is reading the headlines backward from that complaint, because the fines only look like separate scandals if you start with the press releases.

The trilogy, in the order the regulators wrote it

The first bill was €10 million, imposed on December 11, 2023, for failing to inform drivers. The second was €290 million for sending European Economic Area driver data to the United States without the safeguards Article 44 requires. France’s CNIL dates that transfer decision to July 22, 2024. The European Data Protection Board and the Dutch authority made it public in late August 2024, which is why most headlines still say August 26. The third bill is €824,990,000, about $966 million, in a decision dated August 17, 2026, and published on August 21, for automated deactivations. Uber said it would appeal the transfer fine and the deactivation fine. Dutch procedure generally freezes collection while an appeal is live. A posted number is a claim, not a wire.

The transfer case was not a breach. Nobody alleged that a teenager dumped a driver table on a forum. The AP said Uber kept piping European driver data to U.S. systems after the Court of Justice of the European Union tore up Privacy Shield in the Schrems II judgment of July 2020. For roughly twenty-seven months, the regulator argued, the company lacked the contractual and technical wrapping Article 44 demands. The EU-U.S. Data Privacy Framework arrived in July 2023. The Dutch decision treated the gap before the paperwork caught up as a high-severity infringement. Driver files are not marketing emails. They hold identity documents, location traces, payment details, and the account history that decides whether someone works next week. Uber’s defense has been that it used other tools, that the fine ignores later compliance, and that the number is out of scale. An appeal is where those arguments belong. It is not a finding that the AP invented the transfer.

This was not Uber’s first Dutch contact. The AP had already fined the company €600,000 in 2018, before the €10 million information penalty. The GDPR’s usual ceiling, 4 percent of global annual turnover, is why a ride-hail platform with a U.S. parent keeps drawing nine-figure notices from a medium-sized member state. The AP later put Uber’s 2025 global turnover at about €44.5 billion. Amsterdam is the European headquarters. The drivers live in every capital.

What “automated” meant in the €825 million decision

The August 2026 decision is the labor version of a privacy case, and it is the one that changes the scale. The AP found that Uber deactivated driver accounts through software, without what the regulator called meaningful human intervention, and without telling drivers enough about that logic. The CNIL’s summary of the Dutch findings is specific. Temporary deactivations for suspected fraud, and deactivations tied to low customer ratings, were treated as automated individual decisions under Article 22 because a person was not actually in the loop. A blocked account means no rides and no revenue. Deputy chair Monique Verdier said Uber had “committed serious infringements.” “From one moment to the next they no longer had any income,” she said. “A computer should not make decisions on its own that have major consequences.”

Reuters, which reviewed the August 17 decision, called the penalty the second-largest GDPR fine on record, behind Ireland’s €1.2 billion penalty against Meta in 2023 for Facebook transfers to the United States. Meta is appealing that one too. The Uber case grew out of European incidents in 2020 to 2022, including temporary suspensions when systems concluded a driver had taken unnecessary detours or accepted trips without intending to finish them. Uber told Reuters it “strongly disagree[s] with this decision and disproportionate fine,” that the authority examined historic policies discontinued years ago, and that current rules include human review and a way to dispute a suspension. The company has also said only a small number of drivers were affected, citing 126 deactivated in Europe in 2021 because of low ratings. The AP’s position is that some permanent deactivations happened with no meaningful human review. Both sentences can be argued. Neither one erases the €290 million file. It makes that file chapter two of a complaint that started in Paris.

The same week the fine became public, Uber launched autonomous rides in Zagreb, its first robotaxi service in Europe. A company confident enough to put a car without a driver on a Croatian street was, in Amsterdam, defending older software that decided which human drivers got to stay on the platform. The two stories are not the same product. They are the same bet: that scale plus automation will be forgiven, or at least billed later. Daniel Friedlaender of the Computer & Communications Industry Association Europe, whose members include large technology firms, called the fine “truly colossal” and said GDPR enforcement should not become “punishment for punishment’s sake.” TechCrunch reported that a researcher on the driver-complaint side plans a class action through which drivers could seek compensation. A class action and an administrative fine are different pots of money. Drivers’ lawyers will try to use both.

Why the subject keeps being the driver

Passenger data gets the slogans. Driver data gets the fines. Drivers are a workforce Europe can see. They have unions, lawsuits, and account histories that look like employment files even when the contract says they are not employees. Shipping those files to the United States raises the surveillance questions European courts already answered in Schrems II. Shutting the account with software raises the fairness questions Articles 22, 13, and 14 already wrote down. Uber keeps walking into both doors because the platform is the workplace.

The AEGIS Alliance has tracked other European attempts to put a legal handle on a product’s design, including the French investigation of Telegram founder Pavel Durov. Criminal custody and an administrative fine are not the same tool. They are the same instinct. If the product harms people at scale, find a statute that reaches the company that ships it. Related files live under Tech News, Notizie internazionalie Affari.

What an appeal does, and what it does not

Dutch administrative appeals do not work like a press cycle. Collection pauses. The reasoning does not vanish. Other data-protection authorities read the AP’s logic and borrow it. The CNIL already walked its complainants through the one-stop-shop steps and published its own account of the automated-decision findings on August 24, 2026. Investors ask why a compliance story that was supposed to end with the Data Privacy Framework produced a second nine-figure notice. The status is simple. The €290 million transfer penalty is on appeal. The €824.99 million deactivation penalty is on appeal. No public judgment has erased either one. Stacked, the live Dutch paper is more than €1.1 billion, unpaid while the courts work, and that figure does not even count the €10 million information fine that came first.

Companies that only watched the 2024 transfer fight learned the wrong lesson if they thought a new trans-Atlantic framework would end European risk. Frameworks cover some transfers. They do not cover a driver who cannot get a person on the phone after an app shuts the account. The AP has now written both lessons on Uber’s file, and it wrote them because French drivers complained in 2020 about exactly those two things. The courts will decide the price. The record already shows the theory: geography of data, then geography of work.