More and more workplace decisions start with software. A tool ranks CVs before a recruiter reads them. An app hands out shifts and tasks. A fraud filter or rating system decides who stays active on a platform. Often, the people affected never learn who, if anyone, signed off.
European regulators are now putting a price on getting this wrong. In August 2026 the Dutch data protection authority fined Uber €824,990,000 for letting software deactivate drivers' accounts with no human involved. In September, Spain's regulator warned a company about the AI tool it planned to use to screen candidates. And by 2 December 2026, EU countries must have transposed the Platform Work Directive, which says a human, not an algorithm, must decide to suspend or terminate someone's account.
This article is for general information only and is not legal advice. It is a practical guide for business owners, HR leaders and product teams. We covered the Uber ruling itself in our earlier article on the Uber decision; here we look at what it means for everyone who manages people with software.
Why algorithmic management is in the spotlight now
- The Uber decision went Europe-wide. The Autoriteit Persoonsgegevens (AP) announced the fine on 21 August 2026, France's CNIL followed on 24 August, and the European Data Protection Board (EDPB) published a summary on 8 October 2026.
- Spain moved twice. On 23 September the AEPD published a formal warning about an AI recruitment tool. On 7 October it issued guidance on algorithmic systems at work, two days after a new Spanish decree on informing workers about algorithms came into force.
- A deadline is close. Directive (EU) 2024/2831 on platform work must be transposed by 2 December 2026.
- More may follow. On 6 October 2026, 2EU reported that Commission Executive Vice-President Roxana Mînzatu had told the European Parliament that algorithmic management is among the issues being considered for the forthcoming Quality Jobs Act. No text has been published yet, and an issue under consideration does not guarantee a specific measure.
What Uber did, and why the regulator said no
According to the AP, between 2018 and 2022 Uber used software to monitor drivers' behaviour and track customer ratings. When it suspected fraud, or when ratings were too low, it deactivated the driver's account automatically: temporarily, or permanently for persistently low ratings. No human assessment took place, and drivers lost their Uber income while deactivated.
The AP found two GDPR infringements:
- Article 22, which gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. The CNIL explains that the deactivations were automated decisions “due to the complete absence of human intervention”, with a significant effect on drivers who could no longer earn.
- Article 13, because drivers weren't properly informed. Article 13(2)(f) requires “meaningful information about the logic involved” and the consequences for the person.
Three more details matter:
- It started with a complaint. 171 French drivers turned to the Ligue des droits de l'Homme, which complained to the CNIL. Because Uber's European headquarters is in the Netherlands, the AP led the case under the GDPR's one-stop-shop mechanism.
- It is big, but not the maximum. GDPR fines can reach 4% of worldwide turnover. The AP put Uber's 2025 turnover at about €44.5 billion, so the fine is roughly 1.9%.
- It isn't final. Uber has ended the practice but is challenging the fine. It is the AP's fourth fine against Uber, after €600,000 in 2018, €10 million in 2023 and €290 million in 2024; the last two are also contested.
A “human in the loop” has to be real
Few companies build fully automated firing machines. The more common risk is quieter: a tool scores or ranks people, and a human signs off in name only. Spain's AEPD has just addressed exactly that.
Its warning (AI-00009-2026) concerned a tool, not yet in use, that would analyse CVs, score candidates and prioritise them for hiring and internal mobility. The company said a person would always make the final decision, that the tool ignored sensitive attributes and that it was audited periodically. The AEPD's warning and its 7 October guidance note still set out a demanding list:
- Human review must be substantive. The decision-maker must be able to critically assess the score and depart from it. If the human is there only on paper, Article 22 may still apply.
- Track disagreements. Record when reviewers depart from the automated recommendation. A systematic absence of disagreement may signal that people are simply relying on the score.
- Check for proxies. Saying a tool doesn't use sensitive data isn't enough; you must check whether other variables act as proxies for it.
- Group tools don't shift responsibility. If a tool is developed centrally by a corporate group, the local entity using it is still responsible for its own assessment.
- Audits must be verifiable. Document scope, the system version tested, error rates, differential impacts, how well human oversight worked and the corrective measures taken. A statement that systems are “periodically reviewed” is not enough.
- Assess first. Evaluate risks before use and, where risk is likely to be high, carry out a data protection impact assessment (DPIA). Article 35(3)(a) GDPR requires one for systematic and extensive automated evaluation of people on which significant decisions are based. Our article on why AI chatbots are a DPIA problem shows what a DPIA has to cover.
A warning isn't a fine. But the AEPD stressed that it places the burden on the company to adapt and to prove compliance.
Spain has added an employment-law layer, too. Royal Decree 723/2026, in force since 5 October 2026, requires employers to tell each worker in writing about algorithmic or automated decision-making systems and, where these decide working conditions, about their criteria and operating rules. New employees must be told before they start; existing employees can ask, and the employer must answer within 30 working days. The AEPD notes that this doesn't replace GDPR transparency; the duties overlap.
Answer a few questions in our GDPR decision tree to see which obligations apply to a specific use of personal data or AI.
Platform work: from 2 December, a human must decide
The Platform Work Directive is the first EU law written specifically for algorithmic management. It covers digital labour platforms organising work performed in the EU, wherever they are established, and its algorithmic management rules protect everyone doing platform work, including people without an employment contract. Key rules include:
- Forbidden data (Article 7). Automated systems may not process data on emotional or psychological state or private conversations, collect data while the person isn't working, predict the exercise of rights such as union activity, or infer characteristics such as ethnic origin, health or sexual orientation. These limits apply from recruitment onwards.
- DPIAs by default (Article 8). Processing through these systems is deemed likely to be high risk, and platforms must seek the views of workers and their representatives.
- Transparency (Article 9). Workers must be told about the systems affecting them, including their main parameters and the grounds for suspending or terminating an account, by their first working day at the latest.
- Human oversight (Article 10). Platforms must evaluate the impact of automated decisions at least every two years, with staff empowered to override them. Article 10(5): any decision to restrict, suspend or terminate an account “shall be taken by a human being”.
- Explanation and review (Article 11). People get a written statement of reasons for decisions such as a suspension, and can request a review, which must be answered within two weeks.
Data protection authorities will enforce Articles 7 to 11, with the GDPR's highest fine ceiling. Questions remain: the compliance service LexLint asks whether an immediate automated suspension for suspected fraud, reviewed by a human afterwards, satisfies Article 10(5). National laws may answer that.
The AI Act: what already applies, and what's coming
The AI Act (Regulation (EU) 2024/1689) adds another layer:
- Already banned. Since 2 February 2025, Article 5(1)(f) has prohibited AI that infers people's emotions in the workplace or in education, except for medical or safety reasons.
- High-risk from 2 December 2027. Annex III lists AI used to recruit and select people, and AI used for decisions on promotion, termination, task allocation and performance monitoring. After the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026), these high-risk rules apply from 2 December 2027. See our AI Act compliance calendar for the full timeline.
- Tell your workforce. Under Article 26(7), employers deploying a high-risk AI system at work must inform workers' representatives and affected workers before putting it into service. Article 26(11) adds that people subject to decisions made or assisted by such systems must be informed.
None of this waits for 2027 under data protection law. The GDPR, including Article 22, applies to these tools today, and Article 88 lets EU countries set more specific rules on employee data.
Practical checklist for companies using AI to manage people
- ☐ Inventory your decision systems: fraud filters, rating thresholds, CV scoring, shift allocation and performance dashboards, including third-party tools.
- ☐ Find the “solely automated” decisions that block, reject, deactivate or rank people with significant effects.
- ☐ Make human review real: give reviewers time, the underlying data, training and authority to overrule the system.
- ☐ Log overrides. If reviewers never disagree with the tool, find out why.
- ☐ Run a DPIA before launch, and update it when the model, data or purpose changes.
- ☐ Explain in plain language what triggers an action and how people can get a human to review their case.
- ☐ Test for bias and proxies, and keep audit records someone else could verify.
- ☐ Check that no tool infers emotions at work.
- ☐ Involve workers' representatives early.
- ☐ Platforms: follow your national transposition of the Platform Work Directive and make sure suspensions and terminations are decided by a person.
- ☐ Plan for 2 December 2027, when the AI Act's high-risk rules for employment systems apply.
A note for Brazilian readers
Brazil's courts have already applied data protection law to app drivers. In REsp 2.135.783-DF, decided on 18 June 2024, the Superior Court of Justice (STJ) held that a driver removed from a platform has the right, under Article 20 of the LGPD (Law 13.709/2018), to a review of automated decisions defining their professional profile. Summaries of the ruling add that the platform may suspend an account at once for serious misconduct, but must give its reasons and allow the driver to respond afterwards. One difference: the LGPD guarantees a review but, unlike the GDPR, doesn't expressly require human intervention. Brazilian platforms organising work performed in the EU will also fall under the Platform Work Directive.
Conclusion
The Uber case is about drivers, but its lesson applies to any organisation that lets software decide about people. Automation itself isn't illegal. Unexplained, unreviewable decisions that cut off someone's income or career are. Regulators' message is consistent: tell people when algorithms are involved, explain how they work, and put a real person with real authority behind decisions that matter. Companies that do this now will be ready for December's platform rules, the AI Act's 2027 deadline and whatever the Quality Jobs Act brings.
Book a free consultation with GDPRGard → and we will help you review the automated decisions in your HR and operations tools.
Sources
- Autoriteit Persoonsgegevens: Uber krijgt boete van bijna 825 miljoen euro (21 Aug 2026)
- EDPB: Dutch DPA fines Uber EUR 824 990 000 (8 Oct 2026)
- CNIL: Automated decisions, Uber fined nearly EUR 825 million (24 Aug 2026)
- Reuters: Dutch regulator fines Uber $966 million for automating driver suspensions (21 Aug 2026)
- AEPD: La Agencia recuerda las garantías para utilizar IA en el análisis de currículums (23 Sep 2026)
- AEPD: Sistemas algorítmicos en el ámbito laboral (7 Oct 2026)
- A&O Shearman: Spain, AEPD warns on use of AI in recruitment (13 Oct 2026)
- EUR-Lex: Directive (EU) 2024/2831 on improving working conditions in platform work
- EU-OSHA: Directive 2024/2831/EU, platform work
- LexLint: Platform Work Directive, Articles 9 to 11
- LawPlayer: Directive (EU) 2024/2831, Article 10 (human oversight)
- AI Act Service Desk: Article 26, obligations of deployers of high-risk AI systems
- AI Act Service Desk: Annex III, high-risk AI systems
- White & Case: EU AI Omnibus enters into force, amending the AI Act
- 2EU: Commission brings algorithmic management into Quality Jobs Act work (6 Oct 2026)
- GDPR Articles 13, 22, 35 and 88 (gdpr-info.eu)
- Dizer o Direito: STJ, REsp 2.135.783-DF (Aug 2024)
- Brazil: LGPD, Law No. 13.709/2018
Also read:
- Uber's €825M fine: when “the algorithm decided” becomes your liability
- The AI Act was delayed, not cancelled: your 2026 to 2028 compliance calendar
- Your AI chatbot isn't anonymising anything, and that's now a DPIA problem