Facts
Uber permanently deactivated the accounts of four drivers living in the United Kingdom and Portugal, citing fraudulent activity. The notices told the drivers that the deactivation was permanent and irreversible but gave little detail about what they were said to have done. The drivers asked Uber, under Article 15(1)(h) of the General Data Protection Regulation (GDPR), for information about the existence of automated decision-making and the logic involved. Uber refused, saying that employees in its Risk team had reviewed each case and that its fraud-detection methods were trade secrets. On 11 March 2021 the Amsterdam District Court rejected the drivers’ application, finding that there had been meaningful human intervention, and the drivers appealed.
Question
The first question was whether the deactivation decisions were based solely on automated processing within the meaning of Article 22 GDPR. That mattered because the additional information right in Article 15(1)(h) attaches to decisions of that kind. The second was whether Uber could withhold the information altogether by relying on the protection of trade secrets or on the exceptions in Article 41 of the Dutch GDPR Implementation Act (UAVG). Finally, if the right applied, the court had to decide what the information must contain and in how much detail Uber had to describe the way its systems reached their decisions.
Decision
The Court of Appeal held that the decisions concerning three of the four drivers were based solely on automated processing. Uber’s account of the Risk team’s involvement did not show that the review had been anything more than a purely symbolic act. For the fourth driver, who had a personal conversation with Uber before his account was deactivated, there had been meaningful human intervention. Withholding all information on trade-secret grounds was disproportionate. Uber was ordered to provide, within one month, useful information about the underlying logic, including the factors taken into account and their respective weighting at an aggregated level, on pain of a penalty payment (dwangsom) of €4,000 for each day of non-compliance.
Why it matters
The judgment tests, on concrete facts, when human review of an algorithmic deactivation counts as real intervention. The court did not accept the bare assertion that staff were involved; it looked for evidence that the review was more than a symbolic step. It also shows what Article 15(1)(h) requires in practice: enough information on the factors and their weighting for the data subject to understand the decision and to challenge it. The same questions arise wherever platforms manage workers through automated systems.
Related stages
On the same day the court gave judgment in two parallel cases (ECLI:NL:GHAMS:2023:796 against Uber and ECLI:NL:GHAMS:2023:804 against Ola), treating Uber’s batched matching, upfront pricing and average ratings, and Ola’s fraud probability score and earnings profile, as automated decision-making covered by the information right. On 5 October 2023 the Amsterdam District Court found that Uber had not complied with the order and held it liable for €584,000 in penalty payments. The CJEU later addressed the scope of Article 15(1)(h) in Dun & Bradstreet Austria (separate entry).