Who's actually been fined over AI — and why.

The Dutch data protection authority found that, from 2018 to 2022, Uber temporarily or permanently deactivated European drivers' accounts — over suspected fraud or low customer ratings — through a fully automated process with no human review, and without adequately informing drivers this was happening. The case originated with 171 French drivers who complained via the Ligue des droits de l'Homme to France's CNIL, which referred it to the Dutch authority since Uber's EU entity is based in the Netherlands. The regulator's finding, in short: no person ever checked the algorithm's decision before a driver lost their income.

Why it maps to the AI Act: the AI Act's Annex III explicitly classifies AI systems used to make decisions on "termination of work-related contractual relationships" or to monitor and evaluate workers' performance as high-risk — exactly what an automated deactivation-by-algorithm system is. High-risk systems carry a hard obligation under Article 14 for meaningful human oversight, and Article 26 puts the duty on the deployer to ensure a human can actually intervene before the decision takes effect. This case is the fact pattern those two articles exist to prevent.

Clearview scraped billions of publicly posted photos to build a facial-recognition database it sold to law enforcement and private clients, without consent or a legal basis to process biometric data. Five separate EU data protection authorities found this breached GDPR; the Dutch DPA additionally ordered a €100,000-per-day penalty (capped at €5.1M) until Clearview stopped serving Dutch customers and deleted their data.

Why it belongs on this list even though the fines predate AI Act enforcement: the AI Act separately and explicitly bans this exact conduct. Article 5(1)(e) prohibits "the creation or expansion of facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage" — a prohibited practice carrying fines up to €35M or 7% of global turnover, on top of whatever a DPA levies under GDPR.

Italy's data protection authority fined Luka, Inc., maker of the "virtual friendship" chatbot Replika, after finding it processed sensitive emotional and psychological data without a valid legal basis, gave users no clear information about what was collected or why, and had no working age-verification despite the app engaging in sexually suggestive or emotionally manipulative conversation — reaching minors it claimed were excluded. The Garante had already provisionally banned Replika from processing Italian users' data back in 2023 over the same child-safety concerns.

Why it maps to the AI Act: Article 5 bans AI systems that deploy manipulative or deceptive techniques capable of materially distorting behavior (5(1)(a)), and that exploit the vulnerabilities of a specific group such as age (5(1)(b)) — both squarely describe what the Garante found. Article 50 separately requires chatbots to clearly disclose to users that they're talking to an AI.

Short answer: not for the exact same violation, but yes for different violations arising from the same system. GDPR and the AI Act protect different things — GDPR governs personal-data processing (max fines €20M or 4% of global turnover), the AI Act governs product safety and prohibited/high-risk AI uses (max fines €35M or 7% of global turnover for prohibited practices, €15M / 3% for high-risk breaches). Article 99(8) of the AI Act specifically bars imposing both an AI Act fine and a GDPR fine for the same underlying infringement — but a hiring tool that both discriminates unlawfully (an AI Act high-risk breach) and processes candidate data without a valid legal basis (a GDPR breach) can still draw two separate fines, from two separate authorities, for two separate failures.

For a company running a high-risk AI system, this is the practical takeaway: passing a GDPR audit doesn't mean you've cleared AI Act exposure, and vice versa. They're checked, and enforced, independently.