Uber drivers from across Europe have bought a claim in the Netherlands (where Uber's data is based)against Uber claiming that Uber has breached GDPR.
Article 22 GDPR states that, with limited exceptions, data subjects have the right not to be subject to an entirely-automated decision which affects their legal rights. If such an automated decision is made, the data subject shall have the right to an explanation about how the decision was made and to contest the decision.
The claimants in this case say that Uber de-activated their accounts automatically after being they were accused of fraud and were not given the ability to object or information about how the decision had been made. Uber is defending the claim and said that all decisions were subject to a manual review.
This case is of interest for three reasons. Firstly, this is one of the first cases to test the remit of Art 22 GDPR. Secondly, there are concerns that decisions automated through artificial intelligence (AI) can be a "black box" - difficult or impossible to understand. Article 22 is an important mechanism to provide data subjects subject to an automated decision an explanation of how that decision was made. Thirdly, as we wrote about recently (link), the EU Parliament has proposed legislation on the use of AI and an ethical framework for the use of AI. The draft framework identifies employment as a high-risk sector for AI, and recruitment a high-risk use of AI, meaning they will be subject to greater scrutiny and requirements. How the Uber case unfolds will help inform whether the EU's proposals are appropriate, and may be the catalyst for further amendments.