The Dutch privacy regulator has no authority over what Uber builds. On August 21 it fined the company 824,990,000 euros anyway, because software decided when a driver stopped earning and no person looked at that decision first. Read it as a product spec.
What the regulator actually found
Between 2018 and 2022, Uber ran software that watched driver behavior and rider ratings. A fraud flag suspended an account temporarily. Persistent low ratings removed it for good, and with it the driver's income from the platform. The Autoriteit Persoonsgegevens, the Netherlands' data protection authority, found two failures in that chain: no meaningful human involvement in a decision that carried consequences that large, and no adequate explanation to drivers of how the system reached it. Article 22 of the GDPR bans decisions made solely by automated processing when the effect on a person is that significant.
Monique Verdier, deputy chair of the AP, gave the finding in one sentence: "A computer should not make decisions on its own that have major consequences" for a person. The penalty is 824,990,000 euros, roughly 1.85 percent of Uber's 44.5 billion euro 2025 turnover and about 46 percent of the statutory maximum. It is the second largest GDPR fine on record, behind Ireland's 1.2 billion euro penalty against Meta in 2023. Uber has appealed.
I once asked my bank whether my manager was a computer
Years ago my bank locked me out of my own credit card for making too many payments on it in one month. I was paying it down early, for my own convenience, and the security system read that as fraud. I got a person on the phone and asked them to release the lock. They told me they could not override the computer's decision.
So I asked whether their manager was a computer. The rep took offense. No sir, I am the team lead here. Fine, I said, but you just told me you cannot override the computer, so the computer is calling the shots and you are not. Perhaps think about what that means for your career.
That phone call is the Uber ruling in miniature. Somewhere inside that bank there was a documented human review step. On paper a person could reverse the lock. In practice the person on the line had no button, no authority, and no path to anyone who had either. Pedro Domingos framed the general case in The Master Algorithm: the danger was never that computers would get smart enough to take over, it is that they are not smart at all and already run things.
If a human inside your product cannot practically reverse a decision the software made, you did not build an automation. You built an abdication. The override written into the design document does not count. The only one that counts is the one a tired person can actually reach.
Who this bill is addressed to
Article 22 is not a clearance you apply for. There is no premarket review, no pathway, no predicate, no reviewer to negotiate with. It applies to a product already shipping, the moment that product makes an automated call with significant consequences for a person in Europe. For hardware founders used to watching a safety regulator's clock, that is a different clock entirely, and it is already running.
So walk your own system and list the places it decides something about a named human being with nobody in the loop. A diagnostic that scores a scan as negative and sends the patient home. A fleet controller that pulls a vehicle out of service and a driver off shift. An industrial cell that locks out an operator over a safety flag the operator disputes. A monitoring rule that downgrades an alarm at three in the morning. Every one of those is a consequence for a person, decided by software, on a schedule your safety regulator may never inspect.
Automating a bounded task is fine, and I do it every day. The design work is where you draw the boundary and how fast a person can cross back over it. An override nobody can find is a deflection funnel wearing a compliance label, and the AP just showed what that costs when a regulator goes looking for it.
I keep noticing that the regulator here has no safety mandate at all. Uber's vehicle standards and background checks were never on trial: a data protection agency looked at one design decision, the missing human in the loop, and priced it near a billion euros. Go find every place in your own product where a person is nominally in charge and cannot override the machine, and fix it before somebody else puts a number on it.
From Dave’s video library
Dave walks through what an AI copilot changed for the newest support reps, and where the human override has to stay real.
I’m here to help you scale.
Work With DavePrefer a smaller first step? Book a $500 one-hour working session →
Dave Saunders is the founder of Base Reality Group and a Fractional CPO for product companies. He was a founder and operator at Galen Robotics, where the surgical-robotics platform earned FDA De Novo authorization in 2023, and he managed a 35-patent portfolio licensed from Johns Hopkins. He wrote Founders Who Finish and publishes The Build. More about Dave →