The Dutch Data Protection Authority (AP) announced on 21 August 2026 that it had fined Uber about €825 million under the GDPR. Reuters, as carried by The Star, reports that Uber deactivated driver accounts automatically, on suspected fraud or low customer ratings, without adequate human review or information to drivers. The conduct spanned 2018 to 2022, and Uber has said it will appeal.
This is not a data-transfer case, and it should not be described as one. But it belongs in a cross-border data flows discussion because it shows the real shape of European leverage over US platforms. The leverage no longer comes only from rules on where data travels. It increasingly comes from rules on what a company does with the data once it has it.
The case for the regulators
The strongest argument for the fine is a serious one. A driver's account is often their whole income. When software removes it on a fraud flag or a ratings threshold, with no human who can hear the driver's side, the harm is immediate and hard to reverse. GDPR Article 22 restricts decisions based solely on automated processing that significantly affect people. France's CNIL, which cooperated with the AP, says the fine rests on Article 22 and on "the complete absence of human intervention" in the decisions. The Reuters report says the investigation drew on complaints from 171 French drivers. A company that sets the terms of work for many thousands of drivers can reasonably be asked to put a person in the loop.
What the fine is, and is not
The AP has fined Uber before over data. In 2024 it fined Uber €290 million for sending European drivers' data, including licences, location, payment and identity documents, and in some cases criminal and medical data, to US servers for more than two years without a valid transfer instrument. That was a genuine cross-border flows case, and it turned on a compliance gap Uber could close. Uber has since begun using the EU-US Data Privacy Framework (DPF), according to the same report.
The 2026 fine is different in kind. No transfer mechanism is in dispute. The legal theory is about automated decision-making, and the penalty is nearly three times the 2024 one. For US companies the lesson is that cleaning up a transfer arrangement does not buy regulatory peace. Each new theory of liability arrives with its own multiplier.
The framework is not what's on trial
It would be a mistake to read this fine as a sign that transatlantic transfers are collapsing. The DPF rests on the Commission's adequacy decision, Implementing Decision (EU) 2023/1795. On 3 September 2025 the EU General Court dismissed an annulment challenge in Case T-553/23, Latombe v Commission. That ruling is open to appeal to the Court of Justice, so the framework's long-term stability is not guaranteed. Still, nothing in the Uber decision touches it.
That distinction matters for US policy debates. Conflating algorithmic-governance enforcement with transfer law muddies both. It also hands protectionist voices in Washington an easy story, that Europe is simply taxing American firms. And it hands the opposite camp a story that every US platform is a transfer violation waiting to happen. The record supports neither.
The proportionality problem
The pro-innovation objection is not to human review. It is to the design of the penalty and the rule.
First, GDPR fines are capped by a percentage of turnover and are set case by case. A figure of roughly €825 million, the largest the AP has imposed on Uber, arrives with limited ex ante guidance on what compliant review looks like. Is a human who rubber-stamps a flag "meaningful"? How fast must review happen when fraud is live? Platforms need answers that engineers can build to. Fines issued years after the conduct, here 2018 to 2022, teach that lesson slowly and expensively.
Second, blanket human review has costs. Fraud systems exist because manual review at scale is slow and inconsistent, and honest drivers can also be harmed by fraudsters left active. The better regulatory target is a transparent, appealable process, with notice, reasons and a prompt route to a human decision, rather than a ban on automation.
Third, other jurisdictions are watching. If EU enforcement keeps expanding beyond transfers, US companies will face a patchwork of obligations that grows with each decision. A clear safe harbour for documented, appealable automated processes would serve drivers and developers better than headline penalties.
What US policymakers should take from it
For Congress and the Commerce Department, the practical points are narrow.
- Defend the DPF on its merits and on the strength of the reforms behind it, such as Executive Order 14086 and the Data Protection Review Court, which the General Court relied on, rather than treating each EU fine as a threat to it.
- Keep transfer questions and automated-decision questions in separate policy files, so that a dispute over one is not used as a proxy for the other.
- Press for published, predictable guidance from the EDPB and national authorities on what meaningful human review means, so US firms can design to a standard before they are fined for missing it.
Uber's appeal will test whether the AP's reading of Article 22 survives judicial review. The result will say more about the real limits of European algorithmic enforcement than any amount of commentary about transfers. Until then, the sound reading is a modest one. The fine shows that Europe regulates US platforms through many doors, and that stable, specific guidance would reduce the cost of walking through each of them.