The penalty, issued by the Dutch Data Protection Authority, is one of the largest GDPR enforcement actions against a gig-economy platform and tests how far EU regulators will go in applying data law to algorithmic employment decisions.