ECLI:NL:RBAMS:2021:1019
Ruling on March 11, 2021
Authority: Cantonial Court Amsterdam
Parties: Ola drivers / Ola
Subject: General Data Protection Regulation. Processing of personal data. Automated decision-making via an algorithm. Data portability.
Summary of facts: Ola is a digital platform which connects passengers and drivers through an app. Three drivers have requested Ola to give insight into to the personal data which the company has processed by means of a cvs-file or API. Although Ola does provide a couple of digital files, the drivers deem the information incomplete and inconsistent. The drivers address the court with the request to order Ola to provide insight into the personal data which it has processed.
Legal question: Is OIa obliged to grant the drivers access to all personal data, or to specific personal data, it has processed?
Considerations: There is no abuse of law. The persons concerned do not need to offer special reasons as to why they request insight into their personal data. The drivers claim they want to verify the correctness and the lawfulness of the data. That is a good enough reason. The court finds the request to grant the drivers access to all personal data Ola has processed too generic. Ola is allowed to ask for further specification. With regard to the information request concerning specifically mentioned categories the court decides as follows. As to the categories of customer transactions, booking cancellation history, booking acceptance history and GPS-data the drivers have made insufficiently clear that the data is not accessible via the Ola Driver App. Ola does have to provide insight into the anonymized personal data linked to the ratings. It must make sure that the data is not traceable to particular passengers. Furthermore, the application of the fraud probability score leads to profiling. Personal data is used to establish a risk profile to predict the behaviour and reliability of the drivers. Ola must provide insight into the personal data it uses to construct a risk profile. In addition, Ola must provide insight into the personal data it uses with regard to the earning profile, the Guardian system for detection of irregularities, and its decision process regarding penalties and deductions. This does not hold true for the matching system. Ola has provided enough information in the document ‘How we process your data’. The request to transfer the personal data in a certain format is denied. The right of data portability in the GDPR does not entail the right to receive the data in a specific format.
Ruling: Ola has to provide insight into the (anonymized) personal data which is used for the ratings, the fraud probability score, the earning profile, the Guardian system, and the decision process regarding penalties and deductions. The right of data portability in the GDPR does not entail the right to receive the data in a specific format.