The Dutch Data Protection Authority has fined Uber €825 million, about R15.4 billion, over driver accounts deactivated through an automated process without sufficient warning or human oversight. It is the second largest penalty ever issued under GDPR.

Deputy chair Monique Verdier said a computer should not make decisions on its own that carry consequences that severe. Uber says it strongly disagrees, calls the fine disproportionate, and will appeal.

The dispute is factual as much as legal. Uber says most driver suspensions are brief, that no permanent deactivation happens without human review, and that drivers can appeal. The regulator says some drivers were permanently deactivated with no human involved.

The case began with one French driver, Brahim Ben Ali, deactivated in 2019, who collected testimonies from 171 other drivers and filed in the Netherlands, where Uber's European headquarters sit. He was assisted by the Swiss digital rights nonprofit PersonalData.io, whose founder Paul-Olivier Dehaye is now preparing a class action and launching a company, StartClaims, to run similar cases across the gig economy and adtech.

This is the third Dutch fine on Uber, following €290-million (about R5.4-billion) over driver data transfers and €10-million (about R187-million) on related privacy grounds, and Dehaye says all three trace back to the same group of drivers.

TechCrunch reported the fine and carried the counter-argument from Daring Fireball's John Gruber, who worries the ruling makes it unlawful for Uber to monitor drivers running scams or leaving riders stranded. Gruber compares blaming a computer to blaming the time clock when a habitually late employee is dismissed, since managers set the policy and the device only measures compliance. Dehaye's answer is that Uber may use humans to discipline drivers, but must then accept the responsibilities of an employer rather than a marketplace. Reuters broke the story.

Read this as a compliance memo rather than a European news story. Section 71 of POPIA also prohibits decisions based solely on automated processing that carry legal consequences or affect someone substantially, where that processing profiles their conduct, reliability or performance at work.

Suspending a driver, freezing a merchant account, declining a loan, banning a seller: all of it sits inside that definition. The exceptions are narrow and the Information Regulator has not tested them yet. So if your product automates any decision that removes somebody's income, the question is not whether a human can review the appeal.

It is whether a human made the original call. Uber is spending R15-billion arguing about exactly that distinction.

You might also like our piece on why UberX was discontinued in SA, how inDrive's Panorama View launched here first, and what the Lego South Africa data breach showed about who stays responsible under POPIA.

Get more SA tech and business news and subscribe to The Open Letter.