The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has imposed a fine of EUR 824,990,000 on Uber, citing unlawful automated decision-making and insufficient transparency around profiling practices, according to the European Data Protection Board.
The penalty relates to data protection obligations rather than the EU AI Act itself, but the underlying conduct, automated decisions affecting individuals without adequate explanation, sits squarely within the kinds of practices the AI Act seeks to govern where AI systems are used to profile or make decisions about people.
Organisations using algorithmic or automated systems to make decisions that affect drivers, riders, employees, or customers are directly implicated by this type of enforcement action. The case underscores that regulators are prepared to issue substantial fines when automated systems lack adequate transparency or when individuals are not properly informed about how decisions concerning them are made.
The scale of the fine signals that data protection authorities are treating automated decision-making and profiling as high-priority enforcement areas, independent of AI-specific legislation.
For organisations preparing for the EU AI Act, this case is a reminder that automated decision-making systems, particularly those used in employment, gig economy, or consumer contexts, often fall under existing data protection rules as well as emerging AI-specific obligations around transparency and human oversight.
As a compliance matter, entities deploying automated or AI-driven decision systems should ensure documentation of how such systems function, what information is provided to affected individuals, and what mechanisms exist for human review or challenge. These are areas likely to draw scrutiny from both data protection authorities and, once applicable provisions take effect, AI Act market surveillance authorities.