Automated decisions and GDPR: €825 million for missing human approval

An automated decision depriving a driver of their account without human review: the Dutch authority, working with the CNIL, valued the failure at €824,990,000. Human approval is covered by an article of GDPR, and its absence has a price.

On August 24, 2026, the CNIL announced a €824,990,000 penalty imposed on Uber by the Dutch data protection authority in cooperation with the CNIL. The reason fits in one sentence: driver account deactivations classified as automated individual decisions, made without human approval, under Article 22 of GDPR.

What the decision criticises

Uber deactivated accounts for suspected fraud or low ratings. A deactivated driver loses income overnight without knowing which rule triggered it. The Dutch authority found these decisions were made by the processing itself without a person genuinely reviewing them. The same procedure had already produced two penalties: €10 million in December 2023 for failure to inform drivers, €290 million in July 2024 for data transfers outside the European Union, again according to the CNIL page of August 24, 2026.

What Article 22 says

Article 22 of GDPR recognises everyone's right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them. Three exceptions exist: performing a contract, authorisation under Union or Member State law, and explicit consent. None removes the need for serious review when the person challenges the decision. Whether your software falls within this scope is decided with your adviser, not in a journal article: the boundary between decision support and automated decision-making depends on the details of your screens.

A ticked box is not a review

In its July 2026 note on agentic AI and personal data protection, the CNIL recalls the Court of Justice's interpretation in the SCHUFA case of December 7, 2023: human intervention must be real, effective and influence the final decision. The note adds that ‘purely formal or automatic approval is insufficient’. An employee clicking ‘approve’ fifty times an hour on a screen already displaying the answer and offering no alternative does not provide the safeguard the text requires. The same note observes that multiplying agents makes assessing the real degree of supervision difficult, which applies to any processing chain where nobody knows who decided anymore.

What this changes when you commission software

If your application independently rejects a case, suspends access, sets a personalised price or ranks a candidate, you must be able to show where a human intervenes, what information they see and what they can change. This requirement translates into screens, access permissions and appeal rules, hence requirements written before construction. Adding it later means reopening the entire user journey, often a product's most expensive part. This is the kind of topic awkward questions surface in an hour when asked at the right moment.

A prompt-based generation tool asks none of these questions. You describe a screen, it produces it, and nothing in the conversation asks who decides when the machine is wrong. This is true of the market's fastest generators, including those whose credits we examine this morning, and it is not a fault on their part: they sell prototyping speed. At Maestro, every document agents propose stops for your ‘Looks good to me’. This gate concerns project documents, not decisions your application will make once operating. The two reviews are distinct, and the second still needs designing product by product.

In practice

Take the list of actions your software performs without being asked: rejections, suspensions, reminders, scores and priorities. Write three lines for each. Who can challenge it, and through which route? Who reviews it, and within what time? What information does that person see when deciding, and what can they change? If a line stays empty, the issue is open, and it is better discovered in a document than after a complaint. Review organised as an architecture costs a few hours during scoping; the other route is the one Uber took, and its amount appears at the top of this page.