Pursuant to Article 22 of the EU General Data Protection Regulation (GDPR), a data subject has the right not to be subject to a decision based solely on automated processing which produces legal effects concerning him or her or similarly significantly affects him or her. However, this does not apply where the decision is necessary for entering into, or the performance of, a contract between the data subject and the data controller, is authorised by Union or Member State law, or is based on the data subject’s explicit consent. Applying an exception concerning a contract or consent requires that suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are implemented. This includes, at least, the data subject’s right to obtain human intervention on the part of the controller, to express his or her point of view, and to contest the decision.
In addition to the specific conditions imposed on automated decision-making in Article 22 of the GDPR, Article 13 and 14 of the GDPR also require controllers to inform data subjects about the existence of automated decision-making, including profiling. Furthermore, the data subject should be provided with meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
In August 2026, the Dutch Data Protection Supervisory Authority published a press release stating that it had fined Uber nearly 825 million euros for infringing the GDPR’s rules on automated decision-making. Drivers’ accounts were automatically and temporarily deactivated where fraud was suspected or where drivers received low customer reviews. Accounts could also be permanently deactivated where drivers received persistently low customer reviews. While the full decision has not yet been published, the press release states that Uber violated the GDPR’s prohibition on fully automated decision-making and failed to provide drivers with sufficient information about the automated decision-making processes used. The Supervisory Authority emphasized that Uber drivers lost their income through Uber during the deactivations. Thus, the decisions had significant effects on them.
Although the full decision has not yet been published, the Uber case illustrates the practical challenges associated with the application of Article 22 of the GDPR. In particular, it highlights the need to assess not only whether decisions are based solely on automated processing, but also whether such decisions produce legal or similarly significant effects on individuals. The case further demonstrates the close relationship between the GDPR’s substantive requirements concerning automated decision-making and its transparency obligations.
The case also raises broader questions regarding the role of human oversight in automated decision-making. In addition to providing sufficient information about the processing, in the context of algorithmic management on platforms such as Uber, an important question is when human involvement in a decision can be considered meaningful. The European Data Protection Board has accepted a guideline according to which, for human involvement to be regarded as meaningful, the controller must ensure that any review of an automated decision is genuine and capable of influencing the outcome. Such review should be carried out by a person who has the authority and competence to change the decision. As part of the assessment, all relevant information should be taken into account. Controllers should also identify and document the degree of human involvement in the decision-making process and the stage at which such involvement takes place. In the context of platform work, these considerations may be particularly important where automated decisions can affect an individual’s access to work and income.
To conclude, the Uber case highlights that organisations relying on automated decision-making should carefully assess the processing activities and practical safeguards surrounding automated decision-making. In particular, organisations should ensure compliance with transparency obligations, assess whether automated decisions produce legal or similarly significant effects on data subjects, and determine whether a derogation under Article 22 of the GDPR applies or whether meaningful human intervention has been incorporated into the decision-making process. As the use of algorithmic management and automated decision-making continues to expand, these considerations are likely to become increasingly important in demonstrating compliance with the GDPR.
Leave a Reply