The €825 million lesson: is the human review in your AI process real?

On 21 August 2026 the Dutch Data Protection Authority fined Uber €824.99 million for letting algorithms deactivate drivers without meaningful human review. It is one of the largest GDPR fines ever and a clear signal that regulators will use the GDPR, not only the AI Act, to police AI decisions. Uber has said it will appeal.

We covered the facts of the case in our earlier article. This one asks a different question: what would you need to show a regulator to prove that your human review is real?

The short version of the case

Between 2018 and 2022, Uber used automated systems to suspend or permanently deactivate driver accounts over suspected fraud or low ratings. For drivers, deactivation meant losing their income overnight. The complaint that started the case came from drivers in France, and the Dutch authority led the investigation because Uber's EU headquarters is in Amsterdam. It found breaches of Article 22 GDPR, which protects people from decisions based solely on automated processing that significantly affect them, and of the GDPR's transparency rules.

“Human in the loop” has to be real

The most useful part of the decision for businesses is the standard it applies to human oversight. A review only counts if the person has genuine power to change the outcome and actually uses it. A formal sign-off on a machine's output does not.

That matches European case law. In the SCHUFA ruling (C-634/21) the Court of Justice held that producing a score can itself be the “decision” when a third party relies heavily on it. In Dun & Bradstreet Austria (C-203/22) it required companies to explain the procedure and principles actually applied. The common thread is that regulators look at what the system and the people around it actually do, not at what the policy document says.

Five tests a regulator can run

Think of meaningful oversight as five questions, each answerable with evidence:

1. Time. Does the reviewer have enough time per case to form their own view? A queue of 200 cases an hour is not a review.
2. Information. Can the reviewer see why the system flagged this person, not only the score?
3. Authority. Can the reviewer overturn the result without a manager's permission or a justification longer than the one needed to agree?
4. Independence. Is the reviewer measured on agreeing with the system, for example through speed or throughput targets?
5. Outcomes. Do reviewers ever change the result? An override rate of zero is a red flag, not a success metric.

Build the evidence file

For every automated process that affects a person significantly, such as CV screening, credit scoring, fraud flags, pricing or account closure, keep a short file containing:

• a description of the process and where the human step sits;
• the reviewer's role, training and decision authority;
• logs showing review time and override rates, checked quarterly;
• the explanation given to affected people and the route to contest a decision;
• the DPIA covering the process.

If you operate a digital labour platform, note that the EU Platform Work Directive's rules on human oversight and review must be transposed by 2 December 2026, which makes this exercise urgent.

The EDPB is also setting rules for AI training

While enforcement grabs the headlines, the European Data Protection Board is shaping how AI models may be built. On 7 July 2026 it adopted Guidelines 03/2026 on web scraping for generative AI, open for consultation until 30 October. The draft treats legitimate interest as the realistic legal basis for scraping personal data to train AI, but only with strong safeguards:

• clear collection criteria and exclusion of sensitive sources;
• filters for special-category data, which keeps its Article 9 protection even when collected by accident;
• limits on outputs and prompts to stop models revealing personal data;
• respect for opt-outs such as robots.txt and text-and-data-mining reservations.

The practical message: “we took it from the public web” is not a defence. Regulators want to see documented diligence. See our guide to AI training data.

Five lessons for SMBs

1. List your automated decisions. Find every process where software decides something important about a person without a human.
2. Make human review meaningful. Give reviewers time, context and authority, and log when they overturn the system.
3. Explain decisions. Tell people when AI is involved, how they can contest the result and whom to contact.
4. Check your vendors. If you buy AI tools, ask how their models were trained and whether scraped data was filtered.
5. Keep evidence. Policies are not enough. The Uber decision turned on what the system actually did.

The bottom line

The Uber case is a warning written in euros. AI can speed up decisions, but under the GDPR responsibility for those decisions stays with people, and with the company that deploys the system.

Book a free consultation with GDPRGard → and we will help you check whether the human review in your tools would stand up.

Sources

• Autoriteit Persoonsgegevens: Uber fined nearly 825 million euros for automated driver blocking (21 Aug 2026)
• Dastra: €825 million fine, Uber sanctioned for automated decision-making
• EDPB: Guidelines 03/2026 on web scraping for generative AI
• Reed Smith: EDPB web scraping guidelines for AI

Also read:

• Forget the AI Act — GDPR is already fining companies for AI mistakes
• The "It Was Public" Excuse Is Over: GDPR Now Formally Covers AI Training Data
• The high-risk deadline moved to December 2027. The GDPR overlap didn't move at all.