Does Your Automated Decision System Have Real Human Review — or Just a Rubber Stamp?

Uber's €825 million GDPR fine — the second-largest ever issued — came down to one specific, well-defined failure: the Dutch regulator found that account deactivation decisions were fully automated without genuine human review, despite GDPR's clear prohibition on significant automated decisions affecting individuals without meaningful human oversight. As more organizations deploy AI and algorithmic systems for consequential decisions about employees, customers and platform participants, the practical question this case raises is specific: does your review step involve genuine human judgment, or does it just formally exist on paper?

Why 'A Human Can Review It' Isn't the Same as Meaningful Human Review

Regulators and courts interpreting GDPR's automated decision-making provisions have increasingly focused on whether human review is genuinely meaningful — someone with real authority, adequate information, and actual time to review and potentially override the automated output — rather than a purely formal step that exists to satisfy a compliance checklist while the automated decision proceeds essentially unchanged in practice. A human who technically has the ability to override a system, but reviews hundreds of automated decisions per hour with no real capacity to investigate any individual case, does not clearly satisfy a meaningful-human-review standard even though a review step technically exists in the process.

Questions to Ask About Your Own Automated Decision Systems

• Does the human reviewer have enough time and information per case to actually evaluate it, or is the volume structured such that rubber-stamping is the only realistic outcome
• Does the human reviewer have genuine authority to override the automated recommendation, and is that authority actually exercised at a non-trivial rate — a 0% override rate across thousands of decisions is itself a signal worth investigating
• Are affected individuals clearly informed that a decision about them was made, or significantly influenced by, an automated system — this is a separate and distinct GDPR requirement from the human-review requirement itself
• Is the review process documented in a way that would hold up to regulatory scrutiny — not just a policy stating review occurs, but actual records showing what was reviewed and what judgment was applied
• Does this apply beyond the EU — while GDPR is the most tested framework here, similar automated-decision-making protections are appearing in other jurisdictions' AI and privacy regulations, making this a broader compliance question, not solely an EU one

The Practical Takeaway

If your organization uses automated or AI-driven systems to make consequential decisions about people — account actions, credit decisions, hiring screens, benefit eligibility, or similar — audit whether the human review step in that process is genuinely meaningful under the criteria above, rather than assuming a review step's mere existence satisfies the requirement. This Uber case is a concrete, high-value data point on exactly where that line gets tested and enforced.