Uber's €825 million fine, and the police deal that undercuts it

The Dutch Data Protection Authority and France's CNIL fined Uber nearly €825 million this week for automated decisions that affected its drivers, the latest in a string of penalties the platform has faced for how it manages the people who work for it. The fine targets exactly the kind of opaque, algorithm-driven management critics have warned about since gig platforms first automated dispatch and deactivation, and it confirms that GDPR's rules against purely automated decisions have teeth once regulators act on them.

The same week, a different kind of automated decision went live with none of that scrutiny. Bremen has started fitting a third of its tram fleet with an AI behavior scanner that flags passengers it judges aggressive, according to netzpolitik.org, a rollout the outlet describes as proceeding without clear planning or privacy safeguards, and despite trial results that gave little reason for confidence. Nobody is threatening Bremen's transport authority with an Uber-sized fine for that.

And in Brussels itself, the Commission is negotiating an agreement that would widen United States access to European police databases, reported by netzpolitik.org, with privacy advocate Max Schrems among the critics of the draft. It is the same Schrems who was quoted last November calling the legislative practices behind a leaked GDPR reform text Trumpian. The complaint this time is different in substance but not in kind: a European institution moving to hand more of citizens' data across the Atlantic with less public debate than the rules it enforces against private companies.

An algorithm is easy to fine. A government trading away police data is not.

Put the three together and a familiar asymmetry reappears. This month's editorials have tracked how national courts and regulators have grown teeth on paper, a German court forcing Amazon to rebuild its DSA reporting, a Land regulator challenging Berlin's AI Act rollout. Enforcement against companies keeps getting sharper. Scrutiny of what public authorities do before deployment is not keeping pace, whether that is a tram operator installing behavior-scanning cameras or a Commission negotiating data access with a foreign government. A fine the size of Uber's sends a real signal to every platform running automated decisions on Europeans. It sends none at all to the people deciding, on Europeans' behalf, what happens to their data before anyone gets to sue over it.

Consumers…

For Uber's drivers and couriers, this fine is less about the money changing hands between regulators and a platform than about a ruling that the company must let a human, not a black box, take the decisions that end someone's ability to earn from the app. Anyone travelling by tram in Bremen this month is subject to a different kind of automated judgment with far less clarity: the transport authority has yet to explain who reviews a flag from its behavior scanner or what happens next.

Two other German stories point the same direction. HateAid has filed a criminal complaint against Meta over alleged covert recording by its smart glasses, and the country's data protection commissioner has logged a sharp rise in health data breaches this year. None of that is abstract policy: it is what shows up in a consumer's own data trail.

Businesses…

For any company running automated decision-making on customers or gig workers in Europe, Uber's fine is the clearest compliance signal of the year: regulators in more than one member state can and will act on it, and the figure attached is not symbolic. Automated-decision exposure just became a board-level number.

A quieter but related risk surfaced in a report on AI-generated faces defeating identity verification systems. Businesses that lean on facial recognition or simple liveness checks for onboarding or fraud prevention are already behind the technology meant to fool them, and the report ties the problem to the EU AI Act's approach to synthetic content, pushing toward genuine proof of origin rather than pattern recognition alone.

Government…

The Commission's own negotiations with Washington over police database access deserve the same scrutiny Brussels applies to everyone else. Schrems's criticism echoes a warning he made last November about a leaked GDPR reform draft, a pattern of concern about how the EU's own institutions are drafting rules for data that leaves the bloc.

Bremen's tram rollout is a case study for any public body procuring AI: a trial with weak results was not enough to stop a fleet-wide deployment, exactly the kind of pre-deployment gap that this month's AI Act implementation fights, in Germany and elsewhere, are meant to close.

Further today

• Norway's RunwayVC closed a €40 million first close for its second industrial tech fund · EU-Startups
• Europe logged more than 45 tech funding deals worth over €684 million last week · Tech.eu
• German robotics firm NEURA acquired Adlatus Robotics to bring AI to cleaning robots · EU-Startups
• The European Commission is hosting a pitching day for its Apply AI Startup Award finalists · European Commission Digital Strategy
• London's Embedd raised €2.3 million to build software infrastructure for physical AI · EU-Startups
• London's Boldr raised €4.2 million to expand its smart heating and cooling platform · EU-Startups
• Dutch agency UWV outlined a risk-based cybersecurity approach tied to the Cyber Security Act · Digitale Overheid
• CNIL published best practices for protecting personal data in higher education collaboration tools · CNIL
• Boldr raised $5 million to turn UK home energy systems into grid capacity · Tech.eu
• Berlin's Kazimi raised €2.2 million pre-seed to fight bot activity in mobile marketing · Tech.eu
• Bosch will start producing humanoid robots for UK startup Humanoid from 2027 · Presse-Citron
• A seven-country survey found 41 percent of executives expect AI to cut their workforce · Presse-Citron
• Hungarian edtech BOOKR raised €6.1 million to expand its reading and language tools globally · The Recursive
• Berlin's Kazimi also secured €2.2 million to help apps verify data against bots · EU-Startups

Sources

• Confirmed a nearly €825 million fine against Uber over automated decisions affecting drivers · CNIL
• Reported Bremen's rollout of an AI behavior scanner across a third of its tram fleet · netzpolitik.org
• Detailed the EU-US police data access negotiations criticised by Max Schrems · netzpolitik.org
• Covered HateAid's criminal complaint against Meta over its smart glasses in Germany · Heise Online
• Reported a sharp rise in German health data breaches, 428 logged by July · Heise Online
• Examined how AI-generated faces are defeating online identity verification systems · Agenda Digitale