Ruling on April 4, 2023
Authority: Amsterdam Court of Appeal
Parties: Uber / Uber drivers
Subject: Request from Uber drivers to Uber for information concerning their personal data. Request for information on the 'batched matching' system and 'upfront pricing system' used by Uber as well as the determination of average
ratings.
Summary of facts: Appellant drivers are or have been employed as 'private hire drivers' in the United Kingdom using or having used the services of Uber. They are members of the ADCU which is supported by Workers Info Exchange. Uber accused six drivers of ‘having engaged in fraud or activities that may otherwise harm
Uber, its users, and others.’ Therefore, they were deactivated. When asked for further information, Uber only provided a general description of the personal data involved in PDf format.
Legal questions: Does the information request concern decisions that have legal consequences for drivers or otherwise significantly affect them? Can Uber rely on an exception to the information right invoked by the drivers? How should the information request be acted upon?
Considerations: According to the General Data Protection Regulation, the data subject shall have the right to obtain from the controller a confirmation as to whether or not personal data concerning him or her are being processed and, if so, to obtain access to that personal data. The data subject has the right to transfer that data to another controller (data portability). The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or significantly affects him or her in any other way. The GDPR recognizes that automated decision-making, including profiling, can cause serious may affect individuals.
Ruling: Uber wrongly rejected the drivers’ requests for information. The information provided should be complete enough for the data subject to understand the reasons for the decision, or to challenge it. The court ordered Uber to grant the requests of its drivers for access to personal data or to provide access in a commonly used electronic form within one month of service of the order, on pain of a penalty. The provision of data in PDF format cannot be regarded as the provision in a 'structured, common, and machine-readable form.’