Ruling on April 4, 2023
Authority: Amsterdam Court of Appeal
Parties: Ola Netherlands / Drivers
Subject: Request by drivers to Ola Netherlands BV for inspection concerning their personal data. Request for information on the existence of automated decision-making within the meaning of Article 22 GDPR. Request for information including the 'fraud probability score' used by Ola, the 'earning profile' as well as the allocation of journeys to drivers. Drivers also request the portability of certain personal data.
Legal questions: Does the information request concern decisions which have legal consequences for the drivers or otherwise affect them significantly? Can Ola invoke an exception to the drivers' invoked right to information? In what manner must the information request be acted upon?
Summary of facts: Ola is a company whose parent company is based in Bangalore, India. It established the Ola Cabs division in 2010. Ola Cabs is a digital platform that uses an app to facilitate the matching of a passenger and a (taxi) driver. Appellant drivers are employed as 'private hire drivers’ in the United Kingdom. They requested Ola to access all their personal data in a structured, common and machine-readable form. Ola provided a number of digital files and copies of documents to them in response to these requests.
Considerations: In its ‘Privacy Policy,’ Uber says they use automated decision-making (including profiling) without human intervention. ‘We will not process personal data involving automated decision-making unless necessary for the provision of our services or for the performance of a contract.’ According to the General Data Protection Regulation, the data subject shall have the right to obtain from the controller a confirmation as to whether or not personal data concerning him or her are being processed and, if so, to obtain access to that personal data. The controller shall provide the data subject with a copy of the personal data being processed. The data subject has the right to obtain the personal data relating to him that he has provided to a controller in a structured, common and machine-readable form. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling. To achieve actual human intervention, the controller must ensure that all monitoring of decision-making is meaningful and not just a token act. The controller shall implement appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including at least the right to human intervention by the controller, the right to express his or her point of view and the right to challenge the decision. Automated decision-making, including profiling, can have serious consequences for individuals.
Ruling: Ola wrongly rejected the drivers’ requests for information. The information provided should be complete enough for the data subject to understand the reasons for the decision, or to challenge it. The court ordered Ola to grant the requests of its drivers for access to personal data or to provide access in a commonly used electronic form. The provision of data in PDF format cannot be regarded as the provision in a 'structured, common, and machine-readable form.’