Q3 fines: Uber and Google show where GDPR enforcement is heading

European data protection authorities issued the two largest penalties of the third quarter of 2026, against Uber and Google, according to the Corlytics enforcement report, covered by Fintech Global on 6 November. It matters because both decisions target widespread practices: automated decisions about people and the use of location data.

The quarter in numbers

Between July and September, regulators across several countries issued 25 fines of $1m or more, worth roughly $2bn in total. The United States led by number of penalties. Italy’s data regulator and Australia’s financial regulator issued five each. Anti-money laundering and data protection failures accounted for most of the total, and just two data fines make up 71% of its value.

Uber and Google: what was sanctioned

The Dutch authority, the Autoriteit Persoonsgegevens, fined Uber around $955m (€825m) for breaching Article 22 of the GDPR, which restricts decisions based solely on automated processing. According to the reporting, between 2018 and 2022 drivers suspected of fraud or with many low ratings had their accounts suspended without human review.

Separately, Ireland’s Data Protection Commission fined Google around $457m (€403m) after a six-year investigation into location tracking. BEUC’s director general, Agustín Reyna, noted that such data can reveal very intimate details, such as hospitals or places of worship a person visits.

Other signals

Italy’s GPDP was the most active data regulator, penalising Hera Comm, TIM, BBVA and IQVIA. The Hera Comm case concerned a flawed creditworthiness algorithm, which ties in with financial supervisors’ growing interest in data governance for AI systems. Corlytics’ Gaspard Biosse Duplan warned of an “illusion of controls”: policies that exist but are not clearly linked to the risks they are meant to manage.

Our view at CEA Digital Law

At the Euro-American Committee of Digital Law - CEA Digital Law, we suggest reading these fines as a review checklist rather than just a headline figure. Three practical ideas:

• Map automated decisions that affect people (account blocks, scoring, anti-fraud) and document what human involvement really exists, with genuine power to change the outcome.
• Treat location data as high risk: purpose, legal basis, user information and retention periods.
• Trace every control to a specific risk, so policies can be demonstrated to a regulator.

For Latin America and the Caribbean and for Africa, where several recent data protection laws include rights against automated decisions, the Dutch case offers an example of how such clauses may be interpreted. Open questions remain: how “meaningful human intervention” will be defined on large-scale platforms, and whether the treatment of location data will converge across jurisdictions. Cooperating on shared criteria would help businesses and, above all, the people affected.

Sources

• Fintech Global: Data regulators land $1.4bn blow as Q3 fines reach $2bn
• Corlytics: Enforcement report Q3 2026

CEA Digital Law