The Autoriteit Persoonsgegevens (AP) is the data protection authority of the Netherlands. It supervises compliance with the General Data Protection Regulation within Dutch jurisdiction, which includes the use of algorithms and AI systems wherever those systems process personal data (Source: autoriteitpersoonsgegevens.nl).
Supervisory scope and the one-stop-shop mechanism
Because the GDPR routes cross-border cases to the authority of a controller's main EU establishment, the AP acts as lead supervisory authority for a set of companies disproportionate to the size of the Dutch market — any controller headquartered in the Netherlands for EU purposes. Under that mechanism the AP investigates, drafts the decision, and aligns it with the other European supervisory authorities before it issues; where a complaint originates in another member state, the originating regulator participates in the investigation (Source: autoriteitpersoonsgegevens.nl).
Penalty calculation is common across European data protection authorities, with fines capped at 4% of a company's worldwide annual turnover (Source: autoriteitpersoonsgegevens.nl).
Algorithm and AI supervision
The AP treats algorithmic systems as within its remit whenever they process personal data, and identifies unfair or biased decisions and discrimination as the principal risks of automating decisions. It has published guidance on generative AI and the GDPR covering lawful development and deployment of generative models, and a self-assessment tool for organisations evaluating generative AI use that incorporates its prior consultation on Microsoft Copilot (Source: autoriteitpersoonsgegevens.nl).
Its recent AI-adjacent actions include a July 8, 2026 statement that AI increases the risks of cyberattacks and an August 20, 2026 advisory to Twitch users to opt out of sharing data with Amazon AI (Source: autoriteitpersoonsgegevens.nl).
Enforcement against Uber
The AP has fined Uber four times. It imposed €600,000 in 2018 and €10 million in 2023, and €290 million in 2024; Uber is contesting the latter two, and those proceedings remain open (Source: autoriteitpersoonsgegevens.nl).
The fourth and largest, €824,990,000, was announced on August 21, 2026 on a decision dated August 17 and is described in press coverage as the second-largest penalty issued under the GDPR to date (Source: theguardian.com; hln.be). Between 2018 and 2022, software that tracked driving behaviour and customer reviews automatically deactivated drivers' accounts — temporarily on suspicion of fraud or where reviews were too low, and permanently where low reviews persisted — with no human assessment, ending the driver's income through the platform for the duration. The AP ruled that this breached the GDPR prohibition on fully automated decision-making and that Uber had not sufficiently informed drivers that such decisions were being made automatically. Uber has stopped the conduct and has appealed the fine (Source: autoriteitpersoonsgegevens.nl).
Monique Verdier, the AP's deputy chair, said drivers "were deactivated without pardon. From one moment to the next, they no longer had any income through Uber. That's forbidden. A computer should not make decisions on its own that have major consequences for you. These decisions should have been looked at first by a human being" (Source: autoriteitpersoonsgegevens.nl).
The investigation originated outside the Netherlands: 171 French drivers reported to the Ligue des droits de l'Homme, a French human rights organisation, which lodged a complaint on their behalf with the French regulator CNIL. The AP took the case because Uber's European headquarters are in the Netherlands, and cooperated with CNIL throughout (Source: autoriteitpersoonsgegevens.nl).
Relationships
- regulated-by: General Data Protection Regulation (GDPR) — the instrument the AP enforces.
- related: European Data Protection Board (EDPB) — the European Data Protection Board, the body coordinating national supervisory authorities.
- related: CNIL (Commission nationale de l'informatique et des libertés) — co-investigating authority in the Uber driver-deactivation case.
- related: Automated Decision-Making Technology (ADMT) — automated decision-making, the subject of the AP's largest enforcement action.
- related: Meaningful Human Review — the human-assessment standard the AP found absent.
- related: Transportation — AI Deployment — sector in which the enforcement arose.
Sources
- Autoriteit Persoonsgegevens, "Uber fined nearly 825 million euros for automated driver blocking," August 21, 2026 — autoriteitpersoonsgegevens.nl
- Autoriteit Persoonsgegevens, "Algorithms explained" — autoriteitpersoonsgegevens.nl
- The Guardian, "Dutch regulator fines Uber $966m for automating driver suspensions," August 21, 2026 — theguardian.com
- HLN, "Uber krijgt boete van 825 miljoen euro wegens stopzetten accounts chauffeurs," August 21, 2026 — hln.be