automated decision making: what the enforced record shows (2026)
2026-08-29
The debate treats automated decision making as a question about how smart the model is. The enforced record treats it as a question about one thing: was there a human who could review the decision and a way to contest it. Five cases show what happens when the answer is no.
Built on verified case files. The argument below leans on evidence The Internet Ninja validated against the public record and published in full, method included.
- Dutch DPA fines Uber €824.99M for automated driver deactivation without human review
- Dutch DPA fines the Tax Administration €2.75M for unlawful algorithmic nationality profiling
- Italy's Garante fines Foodinho (Glovo) for its rider-management algorithm: €2.6M in 2021, €5M in 2024
- A $2.275M class settlement takes the algorithm's score away: Louis v. SafeRent and the five-year rollback of tenant-screening scores for voucher applicants
- When an AI denial tool reaches federal court: in Lokken v. UnitedHealth, the breach-of-contract claims over 'nH Predict' survive Medicare preemption
The argument about automated decision making usually runs on the wrong axis. It asks how capable the model is, whether the AI is good enough to be trusted with the call. The enforced record asks something simpler and never mentions capability.
It asks whether a human could review the decision, and whether the person on the receiving end had any way to contest it. When the answer is no, the regulator or the court has ruled against the deployer, regardless of how the system was built.
Five cases make the point. Between them they cover a ride-hailing platform, a tax authority, a food-delivery app, a tenant-screening firm, and a health insurer, and the common thread is not the technology. It is the removed human.
What automated decision making means
Automated decision making is a decision made about a person by software, with a legal or similarly significant effect on them, and without meaningful human involvement in the individual case. The category is defined by the process, not the tool, so it covers a fixed rule or a score just as much as a machine-learning model.
That last point matters, because the marketing calls all of it “AI” while the pleadings often say “algorithm.” The enforced trigger is the same either way: a consequential decision that no human meaningfully reviewed.
What are the documented automated decision making examples?
Five, verified against the primary regulator or court record.
Uber, Netherlands, 2026. The Dutch DPA fined Uber 824.99 million euros, ruling that its software automatically deactivated drivers’ accounts between 2018 and 2022 without a human assessing the individual case, a prohibited fully automated decision. TIN’s case file on the Uber fine has the decision detail.
Dutch Tax Administration, Netherlands, 2021. The Dutch DPA fined the tax authority 2.75 million euros for using nationality as an indicator in a self-learning risk-classification algorithm, the engine of the toeslagenaffaire childcare-benefit scandal. TIN’s case file on the tax-authority fine traces it to the regulator’s decision.
Foodinho (Glovo), Italy, 2021. Italy’s Garante fined the food-delivery firm 2.6 million euros because riders were never told how the order-assignment and rating algorithms decided their work and had no way to contest those decisions, and it ordered the algorithms changed. TIN’s case file on the Foodinho sanction documents both that fine and a later 5 million euro one in 2024.
SafeRent, United States, 2024. A class settlement capped total consideration at 2,275,000 dollars and, for five years, barred SafeRent from putting its algorithmic score or an accept-or-decline recommendation on screening reports for housing-voucher applicants. TIN’s case file on Louis v. SafeRent has the orders.
UnitedHealth, United States, 2025. A federal judge let breach-of-contract claims proceed over the naviHealth “nH Predict” model, which plaintiffs allege was used to deny post-acute care to elderly Medicare Advantage enrollees, on the reasoning that the question is whether UnitedHealth followed its own documents saying clinicians decide. TIN’s case file on Lokken v. UnitedHealth has the ruling.
The proof: what TIN verified
TIN checked each of these against the primary record, and the amounts and rulings above are quoted from regulator releases and signed court documents.
Two limits carry through, and both are load-bearing. First, the SafeRent matter settled with no admission and no court finding of discrimination; it proves a payout and a five-year change, not an adjudicated verdict. Second, Lokken is a live case, not a resolved one. What the record establishes is that the breach-of-contract claims survived a motion to dismiss on 13 February 2025, nothing more. The alleged 90 percent error rate for nH Predict is a plaintiff’s contested allegation, and UnitedHealth denies the tool is used to make coverage determinations. TIN cites the ruling, not the allegation as fact.
What does automated decision making mean under the GDPR?
On the record, GDPR enforcement of automated decision making turns on three tests: a lawful basis for the processing, meaningful human involvement in decisions that significantly affect a person, and a genuine ability for that person to contest the outcome.
Uber failed the human-involvement test: the deactivations ran without a human assessing the case. The Dutch Tax Administration failed on lawful basis and on discrimination, using nationality as a risk marker. Foodinho failed on transparency and contestability, giving riders neither an explanation nor an appeal. In each, the model’s accuracy was never the issue the regulator ruled on.
Is automated decision making the same as AI?
No, and the distinction is not academic. Automated decision making is a legal category about how a decision reaches a person, and it captures a hardcoded rule or a statistical score, not only a neural network.
The SafeRent court papers say “algorithm” and describe a numeric score, never “artificial intelligence.” Uber’s deactivation logic is described as software applying rules, not as advanced AI. Treating the label “AI” as the thing that creates the liability misreads every case here. The liability comes from a consequential decision with no human in the loop, whatever the vendor calls the system.
The record in one table
| Company | Regulator or court | What was decided by software | Outcome | Year |
|---|---|---|---|---|
| Uber | Dutch DPA | Driver accounts deactivated without human review | 824.99M euro fine | 2026 |
| Dutch Tax Administration | Dutch DPA | Benefit applicants risk-scored by nationality | 2.75M euro fine | 2021 |
| Foodinho (Glovo) | Italy Garante | Rider ranking with no explanation or appeal | 2.6M euro fine, changes ordered | 2021 |
| SafeRent | D. Mass. | Housing-voucher applicants scored | 2.275M dollar settlement, five-year bar | 2024 |
| UnitedHealth | D. Minn. | Post-acute care denials via nH Predict | Breach-of-contract claims proceed | 2025 |
Short columns, because the pattern is consistent. Different sectors, different regulators, one recurring failure.
The bottom line
The way to read this record is not “automated systems are dangerous,” which counts the technology, and not “these five got unlucky,” which counts nothing. The pattern is exact: every one of these decisions was consequential, automated, and unaccompanied by a human who could review it or a route the affected person could use to contest it. Restore those two things, a meaningful human check and a real appeal, and the sophistication of the model stops being the question. That is the transferable rule, and it is cheaper to build in than to be fined into.
Sources
- Autoriteit Persoonsgegevens (Dutch DPA), “Uber fined nearly 825 million euros for automated driver blocking,” 2026-08-21. https://www.autoriteitpersoonsgegevens.nl/en/current/uber-fined-nearly-825-million-euros-for-automated-driver-blocking
- Autoriteit Persoonsgegevens (Dutch DPA), “Tax Administration fined for discriminatory and unlawful data processing,” 2021-12-07. https://www.autoriteitpersoonsgegevens.nl/en/current/tax-administration-fined-for-discriminatory-and-unlawful-data-processing
- Garante per la protezione dei dati personali, “Provvedimento su Foodinho S.r.l. (docweb 9677377),” 2021-07-05. https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677377
- CourtListener, “Louis v. SafeRent Solutions, LLC, No. 1:22-cv-10800 (D. Mass.) docket,” 2024. https://www.courtlistener.com/docket/63335697/louis-v-saferent-solutions-llc/
- U.S. District Court, District of Minnesota, “Order on motion to dismiss, Estate of Gene B. Lokken et al. v. UnitedHealth Group, No. 0:23-cv-03514,” 2025-02-13. https://www.courthousenews.com/wp-content/uploads/2025/02/UHG-judge-dissmisses-counts-opinion.pdf
Questions
What is automated decision making?
Automated decision making is a decision produced by software about a person, with a legal or similarly significant effect, and with no meaningful human review of the individual case. The enforced record shows the trigger for liability is that missing human step, not the sophistication of the model. Uber was fined because its software deactivated drivers without a human assessing the case.
What are examples of automated decision making?
Documented examples include Uber deactivating driver accounts by software, the Dutch Tax Administration scoring benefit applicants with a self-learning risk algorithm, Foodinho ranking delivery riders by an opaque score, SafeRent scoring housing-voucher applicants, and UnitedHealth's nH Predict model flagging post-acute care denials. Each was challenged by a regulator or a court.
What does GDPR say about automated decision making?
Under the GDPR, a decision based solely on automated processing that significantly affects a person needs a lawful basis, meaningful human involvement, and a route to contest the outcome. On the enforced record, the Dutch DPA fined Uber 824.99 million euros and the Dutch Tax Administration 2.75 million euros, and Italy's Garante fined Foodinho, all over automated processing that failed those tests.
Is automated decision making the same as AI?
No. Automated decision making is a legal category about how a decision is made, and it covers rule-based scores and algorithms, not only machine learning. Several of these court records say algorithm, not artificial intelligence: the SafeRent papers describe a score, and the offense in every case is the absence of human review, whatever the underlying technology is called.
Sources
- Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Uber fined nearly 825 million euros for automated driver blocking , 2026-08-21
- Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Tax Administration fined for discriminatory and unlawful data processing , 2021-12-07
- Garante per la protezione dei dati personali, Provvedimento su Foodinho S.r.l., 10 giugno 2021 (docweb 9677377) , 2021-07-05
- CourtListener, Louis v. SafeRent Solutions, LLC, No. 1:22-cv-10800 (D. Mass.) docket , 2024
- U.S. District Court, District of Minnesota, Order on motion to dismiss, Estate of Gene B. Lokken et al. v. UnitedHealth Group, No. 0:23-cv-03514 (D. Minn.) , 2025-02-13
This is analysis, not a verified outcome. It carries no verification badge and never will. The proof lives in the case files, where every figure is checked against the public record and the method is printed on the page.