Uber fined for deactivation without human intervention

You must now demonstrate that any automated decision affecting a person's income or access to work includes genuine human review with authority to change the outcome, and that you have informed affected individuals in plain language about how that decision is made and what it means for them.

The prompt is an analysis of 8 October 2026 of automated driver deactivation without human intervention, which argues that organisations automating income-determining decisions must verify that human review is meaningful and that affected people understand the profiling at work. The case concerned drivers deactivated on suspicion of fraud or low ratings between 2018 and 2022, losing their ability to earn. In our assessment, this establishes two separate compliance obligations that many organisations treating automated decisions as a technical problem rather than a governance one will have overlooked: human intervention must be real, not ceremonial, and transparency must explain the logic and consequences in language people can actually understand.

What counts as genuine human intervention in an automated decision?

The regulator found that Uber's deactivations were fully automated with no meaningful human assessment. A human reviewer must have the authority to change the outcome, the knowledge to assess the case properly, and enough time to do so. A formal signature after the model has already decided, or a staff member who in practice only confirms what the algorithm determined, does not meet this standard. The reviewer's mandate, expertise and available time should be documented before any income-affecting decision takes effect.

This matters because the European Data Protection Board and the Court of Justice of the European Union have established that where a decision has legal or similarly significant effects—and loss of income clearly qualifies—the person affected has a right to human intervention. That right is meaningless if the human cannot actually change the outcome.

Which concrete controls do you need to demonstrate human intervention?

1. Appoint a named reviewer with documented mandate — record who has authority to change the outcome and on what grounds before the decision is issued.
2. Ensure the reviewer has sufficient knowledge of the case — provide the input data, model version, decision path and any relevant context so assessment is possible.
3. Allocate realistic time for review — do not structure the workflow so that review is a bottleneck that forces rubber-stamping.
4. Retain evidence of what the reviewer actually did — record the reviewer's action, reasoning and any change made to the model's recommendation.
5. Make the objection process usable in practice — allow affected individuals to challenge the decision and ensure their objection reaches someone with authority to reconsider.

What must you tell people about automated profiling?

Uber's second violation was insufficient transparency. The organisation did not give drivers meaningful information about the profiling, the logic behind deactivation decisions, or the consequences for them. A privacy statement that merely mentions the existence of algorithms is not enough. You must explain in plain language what data is used, how it is processed, what the decision logic is, why it matters, and what will happen as a result.

The Court of Justice has clarified that this information must be appropriate and comprehensible. For income-determining decisions, that means a data subject should be able to understand the decision well enough to contest it effectively. Generic statements about algorithmic processing do not meet this standard.

Which transparency obligations apply to your automated decisions?

• Explain the logic of the profiling — describe which data points trigger concern and how they combine to produce a score or flag.
• State the significance of each factor — tell people which inputs matter most and why.
• Describe the envisaged consequences — explain what happens if the decision goes against them: suspension, deactivation, loss of access, or other material harm.
• Use language the affected person can understand — avoid technical jargon and write as though explaining to someone outside your organisation.
• Provide this information before or at the point of decision — do not wait until after deactivation to explain what happened.

What should you retain for audit and challenge?

When an automated decision affects income or access, you should retain the input data, the model or rule version in use, the decision path the system followed, the reviewer's action and any change they made, and the outcome of any objection. This creates an audit trail that allows you to demonstrate later that human intervention occurred and that it was genuine. It also supports accuracy checks: if a reviewer changes the outcome, that signals either that the model needs retraining or that the case was genuinely borderline and required human judgment.

This is not a new requirement invented by the regulator. It follows from the GDPR's accuracy principle applied to automated processing, and from the broader principle that transparency claims should be testable with evidence.

Does this mean you cannot automate income-affecting decisions?

No. The decision does not prohibit automated decision-making. It makes clear that transparency and human intervention are two separate requirements, and that neither can be satisfied by a formal solution when people's income is at stake. You can use models to flag cases for review, to score risk or suitability, or to prioritise which cases a human should examine. What you cannot do is issue an irreversible outcome on the basis of a model alone, or tell people that a decision is final without explaining how it was made.

Tooling can help you structure the workflow, route cases to the right reviewer, and retain the evidence. What remains your professional judgment is whether the reviewer you have appointed can genuinely assess the case, whether the information you are providing is truly meaningful to the person affected, and whether the process you have built actually protects people's income or merely creates the appearance of protection.