Automated decisions: what Uber's GDPR fine means for SMEs
In brief
According to the Dutch AP, Uber B.V. received a EUR 824,990,000 fine for fully automated decisions on drivers and insufficient information. Accounts were auto-deactivated on suspected fraud or low reviews, cutting income. The case, from 171 French driver complaints via the CNIL, covers 2018-2022 under the one-stop-shop. Uber has stopped the violations and appealed; no final judgment yet.
What it changes for an SME
For an SME of 10 to 250 people, the size of this fine is not the lesson. If software or AI blocks an account, scores a person or cuts access without a real human review, the same GDPR rules on automated decisions and information can apply, according to the AP's findings. The practical cost is time spent mapping those processes, the risk of a complaint, and the duty to explain the logic to the people affected. Uber's appeal means the fine is not final, but Articles 22 and 13 of the GDPR already bind you.
What you can do
- List every process where a tool can block, score or refuse a person without a human reviewing the outcome first.
- Check that those people are told about automated decisions or profiling and how they can contest them.
- Add a meaningful human review before any decision that cuts income, access or a contract becomes final.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.