When your automated system deactivates someone's income without human review, you're not running an efficient operation. You're building a GDPR violation at scale.
The Autoriteit Persoonsgegevens' EUR 824,990,000 fine against Uber demonstrates what happens when automated decision-making runs ahead of compliance. Between 2018 and 2022, Uber's systems automatically deactivated driver accounts based on fraud suspicions or low customer reviews. Drivers lost their income. The company lost nearly a billion euros.
Why These Mistakes Keep Happening
Automated decision-making feels operationally necessary. You're managing thousands of users, fraud signals fire constantly, and manual review seems impossible at scale. Article 22 GDPR looks like a theoretical constraint, not an operational reality.
The problem: your efficiency gains become legal liabilities the moment your automation produces legal effects or similarly significant effects on individuals. Losing access to your income stream qualifies. So does permanent account termination. Your system's speed doesn't exempt it from transparency obligations or the requirement for meaningful human intervention.
Mistake 1: Treating Article 22 as Optional Guidance
Why it happens: Teams read Article 22's prohibition on solely automated decision-making, then convince themselves their use case fits an exception. You've got a contract to perform (delivering ride services), so automation must be fine. Or you've built in a token human review step and called it meaningful intervention.
The consequence: The AP found Uber's automated deactivations violated Article 22 because they were fully automated decisions with significant effects. The "contract performance" exception doesn't cover decisions that terminate the contractual relationship itself. Your driver can't perform the contract if you've blocked their account.
The fix: Map every automated decision in your system to Article 22's three-part test. Does it produce legal effects? Does it similarly significantly affect the individual? If yes to either, you need explicit consent, a legal obligation requiring automation, or contract necessity where automation is essential to entering or performing the contract. Document why each decision meets the exception. If you can't articulate it clearly, you don't have an exception.
Mistake 2: Confusing Notification with Meaningful Human Intervention
Why it happens: You've added a step where a human sees the automated decision before it executes. The human can technically override it. You've checked the box on "human intervention," right?
The consequence: Meaningful intervention under Article 22(3) requires the human to have authority and competence to change the decision. If your reviewer sees 200 automated flags per day and overrides fewer than 1%, you don't have meaningful intervention. You have automated decision-making with a notification step.
The fix: Design intervention that actually intervenes. Your reviewer needs access to the factors that triggered the decision, the ability to request additional context, and the authority to override without secondary approval. Document the intervention: what information did the reviewer consider? What alternatives did they evaluate? If you can't answer these questions for each decision, you're not conducting meaningful review.
Mistake 3: Failing Transparency Obligations on Profiling
Why it happens: You've disclosed that you use automated systems. That feels sufficient. Breaking down the specific logic, the data categories, and the significance feels like giving away proprietary algorithms.
The consequence: The AP found Uber provided insufficient information about automated decision-making and profiling. Article 13 and 14 require you to tell data subjects about the existence of automated decision-making, meaningful information about the logic involved, and the significance and envisaged consequences. "We use algorithms to assess performance" doesn't meet this standard.
The fix: Write transparency notices that a driver (or employee, or customer) can actually use. Explain what triggers automated review. Specify which data points feed the decision. Describe the consequence (temporary deactivation, permanent removal, reduced access). If customer ratings below a threshold trigger review, say that. If fraud signals include specific transaction patterns, describe them at a level that's useful without compromising security. The test: could the data subject understand what behavior might trigger the automated decision?
Mistake 4: Assuming the One-Stop-Shop Protects You
Why it happens: Your European headquarters sits in one member state. You've worked with that supervisory authority on other matters. You assume that if issues arise, you'll handle them there with a supervisory authority who knows your business.
The consequence: The One-Stop-Shop mechanism means your lead supervisory authority coordinates, but it doesn't mean other authorities can't raise concerns. In Uber's case, 171 French drivers filed complaints through the Ligue des droits de l'Homme with the CNIL. The CNIL referred the case to the AP under the cooperation procedure. Your lead authority handles the decision, but the complaint can originate anywhere you process data.
The fix: Don't optimize compliance for your lead authority's interpretation. Build systems that meet the strictest reasonable reading of GDPR obligations across member states. When you process data of individuals in multiple countries, your compliance posture needs to withstand scrutiny from any supervisory authority in the cooperation procedure. Document your Article 22 compliance, your transparency obligations, and your human intervention processes as if you'll need to defend them to an authority that hasn't worked with you before.
Mistake 5: Implementing Fixes Without Documenting the Violation Period
Why it happens: You've identified the compliance gap. You've stopped the violating practice. Moving forward with the fix feels more important than documenting what happened during the violation period.
The consequence: The AP noted that Uber has now stopped the violations, but that didn't prevent the EUR 824,990,000 fine. Supervisory authorities assess penalties based on the nature, gravity, and duration of the infringement. The period between 2018 and 2022 represented years of ongoing violations affecting hundreds of drivers. Your current compliance doesn't erase past infringement.
The fix: When you discover an Article 22 violation, document the scope immediately. How many individuals were affected? What was the duration? What was the impact on each individual? This documentation serves two purposes. First, it helps you assess whether you need to notify your supervisory authority (if the violation constitutes a personal data breach or systematic infringement). Second, it demonstrates to the authority that you understand the severity and have taken comprehensive corrective action, which may influence penalty calculations.
Prevention Checklist
Before you deploy any automated system that affects individuals:
- You've identified every decision point that produces legal or similarly significant effects
- You've documented which Article 22 exception applies to each decision point
- You've designed meaningful human intervention with authority to override
- You've written transparency notices explaining the logic, data sources, and consequences
- You've tested whether a data subject could understand what triggers the decision
- You've confirmed your intervention process includes documented reasoning for each review
- You've verified your compliance works across all member states where you process data
- You've established monitoring to detect when automated decisions produce unexpected impacts
- You've created an escalation path when intervention reveals systematic issues with the automated logic
The Uber fine isn't about algorithmic complexity. It's about deploying automated systems that significantly affect people's lives without building in the transparency and human oversight that GDPR requires. Your automation can run fast. Your compliance just needs to run first.
