Uber was fined €825m for letting software decide. The UK changed that rule in February

A regulator has fined Uber the better part of a billion euros because software, and not a person, decided that drivers could no longer work. The story has been going round as a warning, and the instinct it produces is a reasonable one: be careful, automated decisions about people are dangerous ground.

That instinct is right. But if you run a business in Britain and you draw the obvious conclusion from it, you will be working from a rule that this country replaced seven months ago.

The short version

• The Dutch regulator fined Uber €824,990,000 on 21 August 2026 for deactivating drivers with no human assessment.
• That fine rests on the EU's rule against solely automated decisions.
• The UK replaced its version of that rule on 5 February 2026. The default moved from prohibition to permission-with-safeguards.
• You still owe four specific safeguards, and special category data is still restricted.
• ⚠️ The ICO's own guidance page on this still describes the old regime, with no notice that it changed.

What Uber actually did

From the Autoriteit Persoonsgegevens — the Dutch data protection authority — in its own words: Uber used software to track driving behaviour and customer reviews, and where that software flagged suspected fraud or ratings it judged too low, accounts were deactivated. Temporarily at first; permanently for persistent low ratings. The regulator's finding is blunt: “There was no human assessment here.” This ran between 2018 and 2022, and Uber has since stopped.

The deputy chair of the AP, Monique Verdier, put the principle in a sentence worth keeping:

“A computer should not make decisions on its own that have major consequences for you. These decisions should have been looked at first by a human being.”

Two details the coverage tends to drop. The case began with 171 French drivers who went to a human rights organisation, which complained to the French regulator, which routed it to the Dutch one because Uber's European headquarters are here in the EU's one-stop-shop system. And Uber has filed an appeal, so this is not a settled final position.

The number under the number

Everyone is reporting €825 million. The actual figure is €824,990,000, which is a small thing, but it is the sort of small thing that tells you whether a number has been read or repeated.

The larger point is the one nobody does the arithmetic on. The AP notes that European fines are capped at 4% of worldwide annual turnover, and that Uber's global turnover was around €44.5 billion in 2025. Four per cent of that is roughly €1.78 billion.

So the headline-grabbing fine is about 1.9% of turnover — under half of what the regulator could have imposed. Read as a maximum it looks apocalyptic. Read against the cap it looks like a considered penalty with room left above it.

Now the part that matters if you are British

The Uber decision applies the EU GDPR. The UK has its own version, and in February it stopped saying the same thing.

Section 80 of the Data (Use and Access) Act 2025 does something unusually clean: it takes the old Article 22 out and puts four new ones in. The legislation's own words are “For Article 22 of the UK GDPR (automated individual decision-making, including profiling) substitute—”, followed by Articles 22A to 22D. The commencement note records it as in force “at 5.2.2026”.

The old rule began from a no: you could not make solely automated decisions with legal or similarly significant effects unless you fell into one of three permitted cases. The new rule begins from a yes, with conditions. That is a genuine reversal of the starting position, and it happened without much noise.

What the new rule actually requires

It defines “solely”, which the old one never did. Article 22A: “a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision”. The load-bearing word is meaningful. Someone clicking approve on whatever the system produced is not meaningful involvement, and the Act adds that you must consider “the extent to which the decision is reached by means of profiling”.

Special category data is still restricted. Article 22B keeps a prohibition where a significant decision draws on Article 9 data — health, ethnicity, biometrics, trade union membership and the rest — unless explicit consent or a narrow contract or legal condition applies.

And four safeguards are compulsory. Article 22C says the measures must:

“(a) provide the data subject with information about decisions described in paragraph 1 taken in relation to the data subject; (b) enable the data subject to make representations about such decisions; (c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions; (d) enable the data subject to contest such decisions.”

Tell them. Let them argue. Let them reach a human. Let them challenge it. Which is, you will notice, precisely the list Uber failed — so the direction of travel is not as opposite as it first appears. Britain relaxed when you may decide automatically. It did not relax what you owe the person when you do.

The bit that genuinely concerned me

Doing the responsible thing here means going to the regulator's website. So I did.

On 1 September 2026 — and again when I re-checked before publishing this on 3 September — the ICO's page “Rights related to automated decision making including profiling” still described the superseded regime as current law. Its words:

“You can only carry out this type of decision-making where the decision is: necessary for the entry into or performance of a contract; or authorised by domestic law applicable to the controller; or based on the individual’s explicit consent.”

That is the old Article 22 test, and it was replaced nearly seven months earlier. I searched that page for any mention of the Data (Use and Access) Act, or any notice that the guidance was under review. There was none.

To be fair to the ICO, which deserves it: this is not neglect. The regulator has been consulting publicly on new draft guidance for exactly this regime. Its guidance estate is enormous and the Act touched a great deal of it. But on the day I looked, a small business owner doing everything right — going to the official source rather than a law firm's blog — would have come away with the wrong rule.

Which is the practical lesson, and it is not really about data protection. An official page is a statement of what was true when somebody last edited it. When a law changes, check the legislation's own commencement note, because that is the thing that cannot be out of date.

What argues the other way

I am not a lawyer and this is not advice. I have read the Act and quoted it; the application to your particular decisions is a question for someone qualified, and if you are automating anything that affects people's income or access to a service, that is money well spent.

“Permission with safeguards” is not a licence. It would be easy to read the reform as the UK waving automated decisions through. Article 22C is mandatory, the Secretary of State can add to it by regulations under 22D, and the special category restriction is intact. If anything, the reform moves the risk from “are you allowed to do this at all” to “can you show what you put around it” — which is a harder thing to fake and an easier thing to be caught without.

And the ICO page may be updated by the time you read this. I have dated my check deliberately so you can go and see for yourself rather than take my word for it.

If you automate any decision about a person

Rota software that drops someone's shifts. A credit or deposit check that returns a yes or no. A screening step that filters job applicants. An account suspension triggered by a rule. Ask four questions, which are just Article 22C read backwards:

• Does the person know a system made the call?
• Can they put their side of it to you?
• Can they reach an actual human who can look again — not a form that returns the same answer?
• Can they contest it, and would anything change if they were right?

If you are using health data, ethnicity, biometrics or anything else in Article 9, stop and take advice before going further. And if a person somewhere in the process is signing off whatever the screen says without the standing or the information to overturn it, you do not have human involvement. You have a rubber stamp with a salary.

None of this is exotic. It is the same instinct behind knowing whether the EU AI Act reaches a UK business at all: find out which rule is actually pointed at you before you spend a week complying with one that is not.

Sources, all read directly on 1 September 2026. The fine, the quotations from the AP and Monique Verdier, the €824,990,000 figure, the 2018–2022 period, the 171 French drivers, the one-stop-shop routing, the 4% cap, the €44.5 billion 2025 turnover and the appeal are from the Autoriteit Persoonsgegevens' own announcement, “Uber fined nearly 825 million euros for automated driver blocking”, dated 21 August 2026, fetched raw and checked fragment by fragment. The turnover-percentage calculation is ours. The statutory text, the Articles 22A–22D quotations and the 5 February 2026 commencement are from section 80 of the Data (Use and Access) Act 2025 on legislation.gov.uk — the legislation itself, not a summary of it. The ICO quotation and the absence of any update notice are from the ICO's page “Rights related to automated decision making including profiling” as it stood on 1 September and re-fetched byte-for-byte unchanged on 3 September 2026; we checked that one page, not the ICO's whole guidance estate. Not legal advice.