Can an algorithm decide that a company is done with you? The dispute between drivers and Uber in the Netherlands shows that it cannot – not without genuine human assessment. The Amsterdam Court of Appeal described human review of automated deactivations as merely symbolic, and this year the Dutch Data Protection Authority fined Uber almost €825 million. The case is an important warning for every company that uses profiling or AI to manage people.
Uber used software that tracked drivers' driving behaviour and customer ratings. If the system detected a suspicion of fraud – for example, an unnecessary detour to inflate the fare – or if a driver's rating was too low, the driver's account was automatically deactivated, either temporarily or permanently. Overnight, the driver lost their income and often did not even know why.
With the support of Worker Info Exchange and the UK trade union ADCU, the drivers turned to the Dutch courts, as Uber's European headquarters are in Amsterdam. They did not sue under employment law, but under Article 22 of the GDPR, which gives everyone the right not to be subject to a decision based solely on automated processing where that decision significantly affects them.
At first instance in 2021, Uber won. The court accepted that the deactivations had been preceded by an investigation by a specialised team and therefore involved meaningful human intervention.
The turning point came on 4 April 2023. The Amsterdam Court of Appeal (ECLI:NL:GHAMS:2023:793) reached the opposite conclusion:
Uber did not provide the drivers with the required information. In October 2023, the court therefore imposed a penalty of €4,000 for each day of non-compliance, which by then had reached €584,000.
The strongest signal so far came on 21 August 2026. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) fined Uber €824,990,000 – the second-highest fine in the history of the GDPR. According to the authority, between 2018 and 2022 Uber decided on the deactivation of drivers' accounts in a fully automated way and, in addition, did not inform drivers sufficiently about it.
The proceedings were triggered by a complaint from 171 French drivers filed through the Ligue des droits de l'Homme. The amount of the fine is based on the company's worldwide turnover. Uber disagrees with the decision, considers the fine disproportionate and has filed an appeal. It argues that these were historical practices and that its decision-making today includes human review and the possibility to appeal.
The Uber case is not only about platforms. Every company that uses an algorithm to screen candidates, evaluate performance, allocate work or end a working relationship faces the same questions. Six practical lessons follow from it for the future.
1. Human oversight must be real, not a formality. It is not enough for someone to click “approve” at the end of the process. A person must assess the circumstances of the specific case, have the authority to change the algorithm's result and have the necessary knowledge to do so. Article 14 of the AI Act imposes the same requirement on high-risk systems.
2. Human review must be documented. One of the reasons Uber lost in court was that it could not show who reviewed the decisions and with what qualifications. Keep records of who decided, what information they relied on and how often they changed the system's output. If they never change it, that is a warning sign.
3. You must be able to explain the decision. The person concerned has a right to an explanation of which of their data the system used and how. The Court of Justice of the EU confirmed this in its judgment in Case C-203/22 Dun & Bradstreet Austria. A vendor's trade secrets are no reason to refuse an explanation – so make sure your contract obliges the vendor to provide you with the information you need.
4. Inform people in advance and set up a way to appeal. People must know that an algorithm decides, or helps decide, about them, and they must have a way to challenge the decision and request human review. A standard automated message with no explanation whatsoever is exactly what authorities and courts criticise.
5. Protection is not limited to employees. Uber drivers won thanks to the GDPR, not employment law. The same rules therefore apply to the algorithmic management of self-employed contractors, freelancers and suppliers. For platforms, Directive (EU) 2024/2831 on platform work adds further obligations, under which decisions to terminate or suspend the relationship must not be left to an algorithm alone.
6. The risks will grow. Fines under the GDPR can reach up to 4% of worldwide turnover, and the Uber case shows that authorities are willing to use that framework. In addition, from 2 December 2027, AI systems used for recruitment, performance evaluation and termination of employment will become subject to the obligations for high-risk systems under Annex III to the AI Act. The time until then is best used to take stock of your systems and set up your processes.
In the Czech Republic, the Labour Code also applies: an algorithm's output in itself is not a ground for dismissal. We write more about this in the article AI in HR: Opportunities and Limits of Using Artificial Intelligence in Employment Relationships.
The Uber case shows that an algorithm cannot decide on its own to end a working relationship with a person. Human review that merely rubber-stamps the result is not enough, trade secrets do not exempt a company from explaining the decision, and sanctions can reach hundreds of millions of euros. For HR, this means setting up genuine, documented human review, informing the people concerned and preparing for the AI Act obligations for high-risk systems.
How we can help:
If your company uses algorithms to manage people, get in touch – we will be glad to help.
You may also be interested in:
Answers to the questions our clients ask us most often.
Robo-firing describes a situation in which an algorithm effectively decides to end a working relationship, typically by deactivating a worker's account on a platform, without a human meaningfully assessing the case. The best-known example is the dispute between drivers and Uber in the Netherlands, where the Amsterdam Court of Appeal concluded in 2023 that human review of the algorithmic decisions was merely symbolic and that the decisions were therefore based solely on automated processing within the meaning of Article 22 of the GDPR.
On 21 August 2026, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) fined Uber €824,990,000 because, according to the authority, between 2018 and 2022 Uber deactivated drivers' accounts in a fully automated way, without human assessment. Software tracked driving behaviour and customer ratings and automatically blocked the account where it suspected fraud or ratings were low. The authority found this to breach the prohibition of solely automated decision-making under Article 22 of the GDPR, as well as a failure to inform drivers sufficiently. It is the second-highest fine in the history of the GDPR. Uber is challenging it.
Article 22 of the GDPR gives every natural person the right not to be subject to a decision based solely on automated processing of personal data, including profiling, where that decision produces legal effects concerning them or similarly significantly affects them. Typical examples are rejecting a job application, ending a working relationship or blocking access to earnings. Exceptions exist, for example where the decision is necessary for performing a contract or is based on explicit consent, but even then the person concerned must have the right to obtain human intervention, to express their point of view and to contest the decision.
Not always. According to case law and the Dutch supervisory authority, a person must genuinely assess the circumstances of the specific case and must have the authority to change the algorithm's result. If they merely confirm the system's output mechanically, the decision is still based solely on automated processing. An employer should be able to show who reviewed the decision, what qualifications they have, what information they relied on and how often they changed the algorithm's result.
As a rule, no. In the Uber dispute, the Amsterdam Court of Appeal rejected the argument that trade secrets or platform security justify withholding the reasons for an automated decision. In its judgment in Case C-203/22 Dun & Bradstreet Austria, the Court of Justice of the EU confirmed the right to an intelligible explanation of which data were used in an automated decision and how. This does not mean disclosing the source code, but providing an explanation that enables the person concerned to understand and challenge the decision.
Protection under Article 22 of the GDPR covers every natural person, not just employees. Uber drivers won precisely because of the GDPR, even though their employment status was disputed. If a company uses algorithms to evaluate, restrict or end its relationship with self-employed contractors, freelancers or suppliers, it must expect the same requirements for human review, information and explanation of decisions.
An AI output in itself is not a ground for dismissal. An employer may give notice only on the grounds listed in Section 52 of the Czech Labour Code and must be able to prove them. AI can serve as a tool for collecting and evaluating supporting material, for example on work performance, but the decision must be made by a person who genuinely assesses that material. In addition to the Labour Code, the employer must also comply with Article 22 of the GDPR and, from 2 December 2027, with the AI Act obligations for high-risk systems used in employment.
Point 4 of Annex III to the AI Act classifies as high-risk the AI systems used for recruitment, candidate selection, performance evaluation, task allocation or decisions on terminating an employment relationship. Following the amendment by Regulation (EU) 2026/1744, the so-called digital omnibus, the obligations for high-risk systems apply to them from 2 December 2027. The GDPR rules on automated decision-making, however, already apply today, as the Uber case shows.
Five basic steps follow from the Uber case:
