- Should you really be worried, or is this only a problem for giants like Uber?
- What exactly did Uber do, and why was it considered unlawful?
- What does the law actually say: when does an algorithm become unlawful?
- Which Italian companies have already been fined for the same reason?
- Three real-world scenarios: how does the problem show up in an Italian company?
- What tools and approaches exist to get compliant?
- Why now: is the Italian AI market really ready for these rules?
- How to get started: steps to check where you stand
- What are the most common mistakes that lead to fines?
- How can you tell if your automated systems are already compliant?
- So, is your company really at risk, or can you relax?
- How we see it at SHM
- Frequently Asked Questions
- The Dutch authority fined Uber €824.99 million for using algorithms that suspended drivers fully automatically, with no possibility of human intervention, in violation of GDPR Art. 22.
- GDPR Art. 22 prohibits fully automated decisions that significantly affect people: scoring, ranking, suspensions and blocks all fall into this category.
- The Italian Data Protection Authority has already fined energy companies (€7.72 million) and Foodinho/Glovo (€2.6 million) for similar violations: the risk is real for Italian SMEs too.
- Before you receive a notice, map your automated decision flows and make sure they meet transparency, right-to-object and human oversight requirements.
€825 million: that's the fine the Dutch data protection authority imposed on Uber for automatically suspending drivers without human intervention. If an algorithm in your company decides who gets blocked, promoted or excluded, this case concerns you directly.
Should you really be worried, or is this only a problem for giants like Uber?
The Uber fine is the second highest ever issued in Europe for GDPR violations, but the same rules apply to any company that uses algorithms to make decisions about people. The Italian authority has already fined SMEs and mid-sized companies.
When you read about an €825 million fine, the first reaction is: "That's for the giants, not us." That's a mistake. GDPR Art. 22 (the General Data Protection Regulation, the EU's privacy law) applies to every organization that makes automated decisions with significant effects on people. Company size changes the amount of the penalty, not the obligation to comply.
The Italian Data Protection Authority has already fined four energy companies a combined €7.72 million for automated credit scoring without transparency. It fined Foodinho (Glovo group) €2.6 million for the algorithmic management of 19,000 riders. The pattern is clear: authorities are stepping up scrutiny across all sectors.
| Your situation | Real risk? | why |
|---|---|---|
| You use an algorithm to approve or reject requests from customers or suppliers | Yes | Automated decision with significant effect: Art. 22 applies |
| You have a scoring system to evaluate employees or contractors | Yes | Profiling with work-related consequences: maximum attention |
| Your e-commerce store automatically blocks accounts for suspected fraud | Yes | Identical to the Uber case: suspension without human intervention |
| You use AI to recommend products or content with no exclusionary effects | Low risk | No significant effect on the person, but transparency is required |
| Automated decisions are always reviewed by a human operator | Reduced risk | Human oversight is the main safeguard under Art. 22 |
What exactly did Uber do, and why was it considered unlawful?
Uber automatically suspended driver accounts in cases of suspected fraud or overly low ratings, with no human reviewing the decision before it was carried out. This is exactly what GDPR Art. 22 prohibits.
171 French drivers filed a complaint with the CNIL (the French privacy authority) through the Ligue des droits de l'Homme. Because Uber's European headquarters is in the Netherlands, the case was passed to the Dutch authority AP, which investigated the events between 2018 and 2022.
The problem wasn't the use of the algorithm itself. It was that the algorithm made final decisions — temporary or permanent account suspension, with immediate loss of income — without a human being able to step in first. Drivers were not clearly informed about how the rating system worked. Uber has now stopped the violations, but the fine stands. The company has appealed and there is still no final ruling.
| Violation | GDPR Article | What the rule required |
|---|---|---|
| Automated decisions without human intervention | Art. 22 | Right to obtain human intervention, express one's point of view, and contest the decision |
| Insufficient information about profiling | Art. 13 | Obligation to inform people about the logic, significance and consequences of automated processing |
| Lack of transparency about algorithmic logic | Art. 13 + Art. 22 | People must understand how they are evaluated and on what basis |
What does the law actually say: when does an algorithm become unlawful?
GDPR Art. 22 prohibits decisions based solely on automated processing when they produce legal or similarly significant effects on a person. Three exceptions exist, but they require specific conditions.
A decision is "automated" under Art. 22 when no human reviews it before it takes effect. It's not enough that a person could theoretically step in afterward: they must do so before the decision becomes operational.
With its SCHUFA ruling of December 2023, the EU Court of Justice clarified an important point: even the generation of a credit score alone can amount to a prohibited "decision" if third parties rely heavily on that score to grant or refuse contracts. The technical details are explained on aicompliancevendors.com.
| Case | Automated decision? | Exception applicable? | what to do |
|---|---|---|---|
| E-commerce account block for fraud | Yes | Yes, if necessary for the contract | Ensure human intervention on request + clear privacy notice |
| Credit scoring for access to services | Yes | Yes, if provided for by contract or law | Explain the logic involved + right to contest |
| Candidate ranking in HR | Yes | Yes, with explicit consent | Granular consent + mandatory human review |
| Personalized product recommendations | It depends | Often does not apply | Check whether it produces significant exclusionary effects |
| Dynamic pricing without exclusion | no | Not applicable | Sufficient commercial transparency |
Which Italian companies have already been fined for the same reason?
The Italian Data Protection Authority (Garante Privacy) has already issued significant fines against companies in several sectors for the unlawful use of decision-making algorithms. These are not isolated or distant cases.
The Uber case is not a bolt from the blue. In Italy, the authorities have already taken concrete action. In July 2026, the Garante fined four energy companies, including Hera and EstEnergy, for using automated credit scoring systems that denied supply contracts without explaining the algorithm's logic to users. The violation concerned Arts. 13, 14 and 22 of the GDPR: exactly the same articles as in the Uber case.
In 2021, Foodinho (Glovo group) received a €2.6 million fine for the algorithmic management of around 19,000 riders: the system assigned scores and orders without transparency and without any possibility of human intervention. These precedents show that the Italian Garante is active and that no sector is safe.
| Company / Sector | Year | Fine | Main violation |
|---|---|---|---|
| Uber (ride-sharing platform) | 2026 | €824,99M | Automatic driver suspensions, Art. 22 + Art. 13 |
| Hera, EstEnergy + 2 others (energy) | 2026 | €7.72M total | Automated credit scoring without transparency, Art. 13/14/22 |
| Foodinho / Glovo (food delivery) | 2021 | €2,6M | Algorithmic rider ranking without human intervention, Art. 22 |
| Google (advertising / location data) | 2024 | €403M | Processing of location data, Art. 13 |
Three real-world scenarios: how does the problem show up in an Italian company?
Customer scoring, account blocking and ranking of collaborators are the three most common cases in which Italian SMEs risk violating Art. 22 without knowing it.
Illustrative examples: the numbers and situations below are meant to show the reasoning, not real client data.
| Scenario | Typical company | Current risk | What's missing to be compliant |
|---|---|---|---|
| Credit scoring system to accept or reject new B2B customers | Manufacturing company with 80 active customers | High: the decision is automatic and final | Notice explaining the algorithm's logic + human review on request |
| Automatic account blocking for suspected fraud | E-commerce store with 15,000 orders/month | High: identical to the Uber case | Contestation procedure + advance notice to the user |
| Automatic ranking of freelancers or agents to assign jobs | Sales network with 50 agents | Medium-high: significant effects on income | Transparency on criteria + right to human review |
What tools and approaches exist to get compliant?
There are three main paths: an internal audit of your flows, appointing or consulting a DPO, and a technical redesign of automated processes. Often you need all three together.
Getting compliant doesn't mean giving up AI. It means designing your flows around three principles: transparency (people know how they're being evaluated), contestability (they can ask for a human review), proportionality (the algorithm doesn't decide alone on high-impact matters).
| Approach | What it includes | Suitable for | Indicative cost |
|---|---|---|---|
| Internal audit of AI flows | Process mapping, identification of automated decisions, GDPR gap analysis | First step for any company | Low (internal resources + targeted consulting) |
| External DPO (Data Protection Officer) | Ongoing oversight, complaint handling, dealings with the Garante | SMEs without dedicated internal resources | Medium (monthly retainer) |
| Technical redesign of processes | Adding human review steps, decision logging, contestation interfaces | Companies with automated systems already in operation | Medium-high (depends on complexity) |
| Team training | GDPR awareness for those who manage data and AI systems | All companies, as a first step | Low |
Why now: is the Italian AI market really ready for these rules?
The Italian AI market grew by 50% in 2025, but most SMEs still lack adequate governance structures. The gap between technology adoption and regulatory compliance is the real risk.
Last year the Italian Artificial Intelligence market reached €1.8 billion, up 50% from 2024, according to the Artificial Intelligence Observatory of Politecnico di Milano. 71% of large companies have launched at least one AI project. But only 8% of SMEs have done the same.
The problem isn't just adoption: it's governance. According to the Digital Innovation in SMEs Observatory of Politecnico di Milano, 76% of Italian SMEs have neither invested in AI nor plan to, and only 7% have launched structured training programs. Adopting AI without learning the rules leaves you exposed.
How to get started: steps to check where you stand
The starting point is a map of the automated decision-making flows already running in your company. You don't need to wait for a formal audit: three questions are enough to tell whether you're at risk.
- 1 · Management / ITMap all automated processesList every system that makes decisions about people (customers, employees, suppliers, contractors) without systematic human review.
- 2 · DPO or legal counselCheck whether they fall under Art. 22For each process: does it have significant effects? Is it fully automated? If the answer to both is yes, you're in the risk zone.
- 3 · IT / DevelopmentAdd human review stepsDesign a human checkpoint before the decision becomes final, at least upon the data subject's request.
- 4 · Marketing / CommunicationsUpdate your privacy noticesPrivacy policies and user communications must clearly explain the algorithm's logic, the data used and the consequences.
- 5 · HR / TrainingTrain the team that manages the systemsWhoever configures and monitors the algorithms must know the regulatory limits. Training reduces the risk of unintentional violations.
- 6 · ManagementDocument everythingKeep a record of automated decisions, the criteria used and the human reviews carried out. Documentation is your first line of defense in an inspection.
What are the most common mistakes that lead to fines?
Most violations don't come from bad faith, but from three design mistakes that repeat systematically: full automation, generic privacy notices and no logs.
The Uber case shows that the problem wasn't the algorithm itself, but the fact that there was no human checkpoint at all. This mistake is far more common than you might think, even in companies that believe they're compliant.
| Common mistake | Why it's dangerous | How to fix it |
|---|---|---|
| Full automation with no human review | Directly violates Art. 22 if the decision has significant effects | Add a step for human approval or appeal |
| Generic privacy notice ("we use algorithms to improve the service") | Fails the obligation to explain the logic, the data used and the consequences | Rewrite the section with specific details about the automated process |
| No logs of automated decisions | Impossible to prove compliance in an inspection | Implement a logging system with timestamps and the criteria used |
| Confusing "recommendation" with "decision" | Some recommendations have exclusionary effects and fall under Art. 22 | Analyze case by case with a DPO |
| Thinking consent solves everything | Consent is only one of three exceptions, and it must be freely given and granular | Check which exception applies to your specific case |
How can you tell if your automated systems are already compliant?
Five concrete indicators tell you whether your situation is under control or whether you need to act before you get a notice from the Garante.
| Indicator | Compliant | Needs improvement | At risk |
|---|---|---|---|
| There is human review before the decision becomes final | Always, and documented | Only on request | Never |
| The privacy notice explains the algorithm's logic | Specifically and in plain language | In generic terms | Not mentioned |
| People can contest the automated decision | With a clear procedure and defined timelines | In theory yes, but with no procedure | no |
| Automated decisions are recorded (logs) | Yes, with criteria and timestamps | Partially | no |
| The team managing the systems knows Art. 22 | Documented training | Informal knowledge | They aren't aware of it |
So, is your company really at risk, or can you relax?
Worth it if you have systems that make automated decisions about people (customers, employees, contractors) with significant effects — blocks, scoring, ranking — and you haven't yet checked compliance with GDPR Art. 22. Acting now costs less than a fine.
Somewhere in between you use AI to support decisions but always keep human review. Make sure your privacy notices are up to date and that a documented appeal procedure exists.
Not yet if your automated systems don't have significant effects on people, or every decision is always reviewed by an operator before it becomes final. Keep your documentation up to date.
How we see it at SHM
For us, AI is a powerful tool, but its value depends on how it's designed: not to replace human judgment about people, but to support it. The fine on Uber isn't a technology problem — it's a process architecture problem. An algorithm that decides on its own who to block and who not to isn't a well-designed AI system: it's a system that took the human out at the wrong point.
When we work with companies that want to integrate AI into their operational flows, the first step is always to understand where automated decisions have real effects on people. Only then do we design the flow. This approach — which we've also explored in the Project management and technology cluster, in relation to the fine on Meta over personalization algorithms and AI watermarks in text — is what reduces regulatory risk without blocking innovation.
If you're evaluating how to structure or review your automated processes, we can support you with a strategic AI integration program that includes mapping your decision flows, or with a process automation training session for your team. For an initial assessment, get in touch.
Frequently Asked Questions
Yes. GDPR Art. 22 applies to any organization that processes the personal data of people in the EU, regardless of size. Company size affects the maximum amount of the fine (up to 20 million or 4% of global turnover), not the obligation to comply. The Italian Garante has already fined mid-sized companies.
Yes, it's exactly the kind of case that led to the Uber fine. If the block is automatic and final with no human review, and it has significant effects on the user (loss of access, loss of income), it falls under Art. 22. The solution isn't to stop blocking suspicious accounts, but to guarantee an appeal procedure and human review on request.
The notice must explain in plain language: which data the algorithm uses, the general logic of the automated process, the possible consequences for the person, and how to exercise the right to obtain human review. Generic phrases like "we use algorithms to improve the service" are not enough.
Consent is one of the three exceptions provided by Art. 22, but it must be freely given, specific, informed and revocable. It can't be a clause buried in the terms and conditions. The other two exceptions are contractual necessity and authorization by law. In any case, even with a valid exception, transparency obligations and the right to contest the decision still apply.
It depends on the complexity of the systems already in use. A company with one or two simple automated processes can complete the mapping and update its privacy notices in a few weeks. Companies with more complex systems — customer scoring, contractor ranking, automatic blocks — may need two to six months for a full redesign of their flows with legal oversight.
No. Uber appealed the fine and there is still no final court ruling. The fine was issued by the Dutch authority AP in October 2026, but the legal proceedings are still ongoing. This doesn't change the obligation for other companies to comply with Art. 22: the violations alleged against Uber were established and the company has already stopped the contested practices.
The real question isn't whether your algorithms are smart, but whether they're designed to respect the people they make decisions about.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
