On August 21, 2026, the Dutch data protection authority has sanctioned the company Uber for breach of article 22 of the GDPR on automated decisions. An appeal by Uber against the fine, equal to no less than €824,990,000 (yes, all those zeros!), is pending.

Rules on automated decisions.  Section 22 of the GDPR sets forth that the data subject is entitled not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Certain exceptions to this rule apply, namely if the decision is necessary to enter into or perform a contract with the data controller, if it is provided by law, or if it is based on express consent of the data subject. Changes to the provision may be brought by the Digital Omnibus proposal, but are not yet in force.

An entirely automated decision.  The data protection authority found that between 2018 and 2022 Uber used software to track drivers’ conduct and customers reviews, which would automatically deactivate the driver’s account in case of suspicion of fraud or if customer reviews were bad. The account’s deactivation implied no human assessment and was found to be entirely automatic.

The previous SCHUFA case.  The European Court of Justice tackled a similar issue in the Schufa case of December 7, 2023. In that case, the decision process was more articulated, with an automated first step and a second step involving a human decision heavily relying on the first step. The Court ruled that a credit information agency setting forth “a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future constitutes ‘automated individual decision-making’ within the meaning of that provision, where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person”. The Court justified this broad interpretation by pointing to the risk, where three parties are involved, of circumventing Article 22 and creating a gap in legal protection if the calculation of the probability value were classified merely as a preparatory act.

Are AI decisions better than human decisions?  An optimistic view argues that AI-based hiring of employees may result in a less biased human resources function. On the other hand, a more commonly shared opinion is concerned that AI decisions, which can be as biased as human decisions, are becoming fully independent from instructions received by humans (e.g., Ukrainians have started to be killed by drones entirely guided by AI).

Conclusions. The GDPR bans fully automated decisions and requires “human-in-the-loop” processes whenever such decision produces legal effects or significantly affects a person. Section 22 of the GDPR can be seen, and is being interpreted, as a safeguard for EU citizens against fully automated decisions.