Ruling on April 4, 2023
Authority: Amsterdam Court of Appeal
Parties: Uber / Drivers
Subject: Request from Uber drivers to Uber for information concerning their personal data after their accounts were deactivated by Uber.
Summary of facts: Appellant drivers were employed as Uber drivers using Uber's services through the Driver app. Drivers received a notice from Uber informing them that their Uber Driver account had been deactivated because Uber determined that they had breached Uber's applicable contractual terms and conditions by committing fraud. As a result of the deactivation, they could no longer perform work through Uber, leading to a significant loss of income. There was no personal contact with the drivers, and the drivers were not heard in any way.
Legal questions: Are the deactivation decisions based solely on automated processing? Can Uber rely on an exception to the information right invoked by the drivers? How should the information request be acted upon?
Considerations: According to the General Data Protection Regulation, the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or significantly affects him or her in any other way. The data subject has the right to express his or her point of view and the right to challenge the decision. The controller must ensure that all monitoring of decision-making is meaningful and not just a token act. The GDPR recognizes that automated decision-making, including profiling, can seriously affect individuals and their financial situation or their employment situation. Although Uber claimed that one or more persons from the Risk team, based in Cracow, carried out manual investigations in each case after they had received a signal of possible fraud, they do not in any way show that that action was much more than a purely symbolic act. The court also could not cite any examples or concrete numbers of cases in which a driver, after an initial warning and temporary blocking of his or her account, was subsequently contacted by the Risk team and in which, based on a conversation, it was then finally decided whether or not to permanently deactivate the account.
Ruling: The court ordered Uber to provide drivers with copies of or access to their personal data to the extent that it formed the basis of the decision to deactivate their accounts in such a way as to enable them to verify the accuracy and lawfulness of the processing of their personal data. It cannot be concluded that the decisions to deactivate the drivers’ accounts are based solely on automated processing. All cases involved meaningful human intervention. The automated decision has no legal effect. Ultimately, Uber has not sufficiently argued for the opinion that a complete rejection would be proportionate and necessary with a view to protecting its trade secrets.