- Is it worth worrying about, or is it a problem only for giants like Uber?
- What exactly did Uber do and why was it considered illegal?
- What exactly does the law say: when does an algorithm become illegal?
- Which Italian companies have already been sanctioned for the same reason?
- Three concrete scenarios: how does the problem manifest in an Italian company?
- What tools and approaches are out there to get compliant?
- Why are we talking about it now: is the Italian AI market really ready for these rules?
- How to start concretely: the steps to check your situation?
- What are the most common mistakes that lead to fines?
- How to figure out if your automated systems are already compliant?
- So, is your company really at risk or can you rest easy?
- How we see it at SHM
- Frequently Asked Questions
- The Dutch authority fined Uber 824.99 million euros for using algorithms that suspended drivers completely automatically, with no possibility of human intervention, in violation of Art. 22 of the GDPR.
- Article 22 of the GDPR prohibits entirely automated decisions that produce significant effects on people: scoring, ranking, suspensions, and blocks all fall into this category.
- The Italian Privacy Guarantor has already penalized energy companies (7.72 million) and Foodinho/Glovo (2.6 million) for similar violations: the risk is very real for Italian SMEs too.
- Before getting a notification, map out your automated decision-making workflows and check that they respect transparency, the right to object, and human oversight.
825 million euros: this is the fine that the Dutch data protection authority slapped on Uber for automatically suspending drivers without human intervention. If an algorithm in your company decides who to block, who to promote, or who to exclude, this case affects you directly.
Is it worth worrying about, or is it a problem only for giants like Uber?
The fine against Uber is the second highest ever issued in Europe for GDPR violations, but the same rules apply to any company using algorithms to make decisions about people. The Italian Data Protection Authority has already sanctioned SMEs and medium-sized businesses.
When you read about an 825 million fine, the first reaction is: "It concerns the giants, not us" . That's a mistake. Article 22 of the GDPR (General Data Protection Regulation, the European privacy law) applies to any organization that makes automated decisions with significant effects on people. The size of the company changes the fine amount, not the obligation to follow the rule.
The Italian Privacy Authority has already sanctioned four energy companies with 7.72 million euros in total for automatic credit scoring without transparency. It sanctioned Foodinho (Glovo group) with 2.6 million euros for the algorithmic management of 19,000 riders. The pattern is clear: the authorities are raising the bar of attention across all sectors.
| Your situation | Real risk? | why |
|---|---|---|
| You use an algorithm to approve or reject requests from customers or suppliers | Yes | Automated decision with significant effect: Art. 22 applies |
| Do you have a scoring system to evaluate employees or collaborators | Yes | Profiling with employment consequences: maximum attention |
| Your e-commerce automatically blocks accounts for suspected fraud | Yes | Identical to the Uber case: suspension without human intervention |
| Uses AI to recommend products or content without exclusionary effects | Low risk | No significant effect on the person, but transparency is needed |
| Automatic decisions are always reviewed by a human operator | Reduced risk | Human oversight is the main exemption under Article 22 |
What exactly did Uber do and why was it considered illegal?
Uber automatically suspended drivers' accounts in case of suspected fraud or overly low reviews, without any human reviewing the decision before execution. This is precisely what Art. 22 of the GDPR prohibits.
171 French drivers filed a complaint through the Human Rights League with the CNIL (the French privacy authority). Since Uber's European headquarters is in the Netherlands, the case was transferred to the Dutch AP authority, which investigated the events between 2018 and 2022.
The problem wasn't the use of the algorithm itself. It was that the algorithm made decisions definitive — temporary or permanent account suspension, with immediate loss of income — without a human being able to intervene beforehand. Drivers were not clearly informed about how the rating system worked. Uber has now stopped the violations, but the fine remains. The company has appealed and there is no final ruling yet.
| Violation | GDPR Article | What the rule required |
|---|---|---|
| Automated decisions without human intervention | Art. 22 | Right to obtain human intervention, express one's point of view, contest the decision |
| Insufficient info on profiling | Art. 13 | Obligation to inform people about the logic, significance, and consequences of automated processing |
| Lack of transparency on algorithmic logic | Art. 13 + Art. 22 | People need to understand how they are evaluated and on what basis |
What exactly does the law say: when does an algorithm become illegal?
Art. 22 of the GDPR bans decisions based solely on automated processing when they produce legal or similarly significant effects on the individual. Three exceptions exist, but they require precise conditions.
A decision is "automated" under Article 22 when no human being reviews it before it produces effects. It is not enough for a human to theoretically be able to intervene afterwards: they must do so before for the decision to take effect.
The EU Court of Justice, with the SCHUFA ruling of December 2023, clarified an important point: even the mere generation of a credit score (a credit score) can constitute a prohibited "decision" if third parties heavily rely on that score to grant or deny contracts. The technical details are explained on aicompliancevendors.com.
| Case | Automated decision? | Applicable exception? | what to do |
|---|---|---|---|
| E-commerce account block for fraud | Yes | Yes, if required by contract | Guarantee human intervention upon request + clear privacy notice |
| Credit scoring for service access | Yes | Yes, if required by contract or law | Inform about the logic + right to object |
| Candidate ranking in HR | Yes | Yes, with explicit consent | Granular consent + mandatory human review |
| Personalized product recommendation | It depends | Often not applicable | Check if it produces significant excluding effects |
| Dynamic pricing without exclusion | no | Not applicable | Sufficient commercial transparency |
Which Italian companies have already been sanctioned for the same reason?
The Italian Privacy Guarantor has already issued heavy fines against companies in various sectors for the illegal use of decision-making algorithms. These aren't isolated or far-fetched cases.
The Uber case is not a bolt from the blue. In Italy, the authorities have already taken concrete action. In July 2026, the Guarantor fined four energy sector companies — including Hera and EstEnergy — for using automated credit scoring systems that denied supply contracts without explaining the algorithm's logic to users. The violation concerned Articles 13, 14, and 22 of the GDPR: exactly the same articles as in the Uber case.
In 2021, Foodinho (Glovo group) received a 2.6 million fine for the algorithmic management of about 19,000 riders: the system assigned scores and orders without transparency and without any chance for human intervention. These precedents show that the Italian Data Protection Authority is active and no sector is safe.
| Company / Sector | Year | Fine | Main violation |
|---|---|---|---|
| Uber (ride-sharing platform) | 2026 | †824.99M | Automatic driver suspensions, Art. 22 + Art. 13 |
| Hera, EstEnergy + 2 others (energy) | 2026 | †7.72M total | Automated credit scoring without transparency, Art. 13/14/22 |
| Foodinho / Glovo (food delivery) | 2021 | †2.6M | Algorithmic rider ranking without human intervention, Art. 22 |
| Google (advertising / location data) | 2024 | †403M | Geolocation data processing, Art. 13 |
Three concrete scenarios: how does the problem manifest in an Italian company?
Customer scoring, account blocking, and employee rankings are the three most common cases where Italian SMEs risk violating Article 22 without knowing it.
Illustrative examples: the numbers and situations below serve to show the reasoning, they are not real customer data.
| Scenario | Typical company | Current risk | What is missing to be compliant |
|---|---|---|---|
| Credit scoring system to accept or reject new B2B clients | Manufacturing company with 80 active clients | High: the decision is automatic and final | Algorithm logic disclosure + human review on request |
| Automatic account block for suspected fraud | E-commerce with 15,000 orders/month | High: identical to the Uber case | Dispute procedure + advance notice to the user |
| Automatic ranking of freelancers or agents to assign orders | Sales network with 50 agents | Medium-high: significant impact on income | Transparency on criteria + right to human review |
What tools and approaches are out there to get compliant?
There are three main paths: internal flow audits, appointing or consulting a DPO, and the technical redesign of automated processes. Often, you need all three together.
Getting compliant doesn't mean stopping using AI. It means designing workflows that respect three principles: transparency (people know how they are evaluated), contestability (they can request a human review), proportionality (the algorithm does not make decisions alone on high-impact matters).
| Approach | What it includes | Suitable for | Estimated cost |
|---|---|---|---|
| Internal audit of AI flows | Process mapping, identification of automated decisions, GDPR gap analysis | First phase for any company | Low (internal resources + targeted consulting) |
| External DPO (Data Protection Officer) | Continuous supervision, complaint management, reporting to the Authority | SMEs with no dedicated internal resources | Medium (monthly retainer) |
| Technical redesign of processes | Addition of human review steps, decision logging, dispute interfaces | Companies with automated systems already up and running | Medium-high (depends on complexity) |
| Team training | GDPR awareness for those managing data and AI systems | All companies, as a first step | Low |
Why are we talking about it now: is the Italian AI market really ready for these rules?
The Italian AI market grew by 50% in 2025, but most SMEs still lack adequate governance structures. The gap between tech adoption and regulatory compliance is the real risk.
Last year the Italian Artificial Intelligence market reached 1.8 billion euros, with a 50% growth compared to 2024, according to the Artificial Intelligence Observatory of the Polytechnic University of Milan . 71% of large companies have started at least one AI project. But only 8% of SMEs have done the same.
The problem isn't just adoption: it's governance. According to the Digital Innovation Observatory in SMEs of Politecnico di Milano , 76% of Italian SMEs have not invested nor plan to invest in AI, and only 7% have started structured training programs. Those who adopt AI without training on the rules are exposed.
How to start concretely: the steps to check your situation?
The starting point is mapping out the automated decision-making flows already active in your company. No need to wait for a formal audit: just three questions to figure out if you're at risk.
- 1 Management / IT Map all automated processes List every system that makes decisions about people (customers, employees, suppliers, collaborators) without systematic human review.
- 2 · DPO or legal consultant Check if they fall under Art. 22 For each process: does it produce significant effects? Is it fully automated? If yes to both, you are in a risk zone.
- 3 IT / Development Add human review steps Design a human checkpoint before the decision becomes final, at least upon the request of the interested party.
- 4 · Marketing / Communication Update the privacy policies Privacy policies and user communications must clearly explain the logic of the algorithm, the data used, and the consequences.
- 5 HR / Training Train the team running the systems Those who configure and monitor algorithms must know the regulatory limits. Training reduces the risk of unintentional violations.
- 6 · Management Document everything Keep track of automated decisions, the criteria used, and any human reviews carried out. Documentation is your first line of defense in the event of an inspection.
What are the most common mistakes that lead to fines?
Most violations do not stem from bad faith, but from three design errors that repeat systematically: total automation, generic privacy notices, and the absence of logs.
The Uber case shows that the problem wasn't the algorithm itself, but the fact that there was no human control point. This mistake is much more common than you think, even in companies that believe they are compliant.
| Common mistake | Why it is dangerous | How to fix it |
|---|---|---|
| Total automation without human review | Directly violates Art. 22 if the decision has significant effects | Add a step for human approval or dispute |
| Generic privacy policy (‘we use algorithms to improve the service’) | Does not fulfill the obligation to explain the logic, data used, and consequences | Rewrite the section with specific details on the automated process |
| No logs of automated decisions | Impossible to prove compliance in case of an inspection | Implement a logging system with timestamps and criteria used |
| Confusing 'recommendation' with 'decision' | Some recommendations produce exclusionary effects and fall under Art. 22 | Analyze case by case with a DPO |
| Thinking consent fixes everything | Consent is only one of the three exceptions, and must be free and granular | Check which exception applies to your specific case |
How to figure out if your automated systems are already compliant?
Five concrete indicators tell you if your situation is under control or if you need to act before receiving a notification from the Authority.
| Indicator | Compliant | Needs improvement | At risk |
|---|---|---|---|
| There is human review before the decision becomes final | Always and documented | Upon request only | Never |
| The privacy policy explains the algorithm's logic | In a specific and understandable way | In a generic way | Not mentioned |
| People can challenge the automated decision | With a clear procedure and set times | Theoretically yes, but without a procedure | no |
| Automated decisions are recorded (logs) | Yes, with criteria and timestamp | Partially | no |
| The team managing the systems knows Art. 22 | Documented training | Informal knowledge | I am not aware of it |
So, is your company really at risk or can you rest easy?
It is worth it if you have systems that make automated decisions about people (customers, employees, collaborators) with significant effects — blocks, scoring, ranking — and you haven't checked compliance with Art. 22 GDPR yet. Acting now costs less than a fine.
A middle ground you use AI to support decisions but always keep a human in the loop. Make sure your privacy notices are up to date and that there's a documented dispute process in place.
Not yet if Your automated systems do not produce significant effects on people, or every decision is always reviewed by an operator before becoming final. Keep your documentation up to date.
How we see it at SHM
For us, AI is a powerful tool, but its value depends on how it is designed: not to replace human judgment over people, but to support it. The fine against Uber is not a technology problem — it is a process architecture problem. An algorithm that decides by itself who to block and who not to is not a well-designed AI system: it is a system that has removed the human being at the wrong point.
When we work with companies that want to integrate AI into their operational flows, the first step is always to figure out where the automated decision produces real effects on people. Only then do we design the flow. This approach — which in the cluster Project management and technology we also explored in relation to fine against Meta for personalization algorithms and AI watermark in texts — is what reduces regulatory risk without blocking innovation.
If you are considering how to structure or verify your automated processes, we can support you with a AI strategic integration path which includes mapping decision flows, or with an intervention by training on process automation for your team. For an initial assessment, Write to us .
Frequently Asked Questions
Yes. GDPR Article 22 applies to any organization handling personal data of people in the EU, no matter how big or small they are. A company's size only changes the maximum fine they could face (up to 20 million euros or 4% of global turnover), not whether they have to follow the rule. The Italian Data Protection Authority (Garante) has already handed out fines to mid-sized companies.
Yes, that's exactly the kind of case that led to Uber's fine. If the block is automatic and final without human review, and has significant effects on the user (loss of access, loss of income), it falls under Art. 22. The solution isn't to stop blocking suspicious accounts, but to guarantee an appeals process and human review upon request.
The privacy notice must explain in a clear way: what data is used by the algorithm, the general logic of the automated process, the potential consequences for the individual, and how to exercise the right to get human review. Generic phrases like 'we use algorithms to improve the service' are not enough.
Consent is one of the three exceptions provided under Art. 22, but it must be freely given, specific, informed, and revocable. It cannot be a hidden clause in the terms and conditions. The other two exceptions are contractual necessity and legal authorization. In any case, even with a valid exception, the obligations of transparency and guaranteeing the right to contest remain.
It depends on how complicated the systems you already use are. A company with just one or two simple automated processes can map everything out and update their privacy notices in a few weeks. Companies with more complex setups — like customer scoring, employee ranking, or automatic account blocks — might need anywhere from two to six months for a total workflow redesign with legal oversight.
No. Uber has appealed the fine and there is currently no final judicial ruling yet. The fine was issued by the Dutch authority AP in October 2026, but the legal proceedings are still ongoing. This does not change the obligation for other companies to comply with Art. 22: the violations alleged against Uber have been established and the company has already stopped the contested practices.
The real question is not whether your algorithms are intelligent, but whether they are designed to respect the people they make decisions about.
Related articles
Discover more articles exploring similar topics, selected to offer you a more complete and stimulating perspective. Each piece of content is carefully chosen to enrich your experience.
