GHAMS - 200.295.747/01
| GHAMS - 200.295.747/01 | |
|---|---|
 | |
| Court: | GHAMS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 15(1)(h) GDPR |
| Decided: | 04.04.2023 |
| Published: | 04.04.2023 |
| Parties: | |
| National Case Number/Name: | 200.295.747/01 |
| European Case Law Identifier: | ECLI:NL:GHAMS:2023:796 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | Anton Ekker |
A Dutch Court of Appeal ordered Uber to provide drivers with access to their personal data and information about automated decision-making. The Court subjected the controller to a penalty of €4,000 per day until compliance.
English Summary
Facts
This decision is the result of an appeal (and incidental appeals) filed against a decision from the District Court of Amsterdam (available on GDPRhub). The District Court ordered Uber to provide its drivers with information regarding the their rating by passengers but rejected several other requests for information under Article 15.
The different drivers had different requests in appeal. This included information about device data, driver's profile, tags (labels in the custumer service system), reports per journey, individual ratings per passenger, upfront pricing and batched matching system. Under Article 15, they also requested information about the recipients, the processing purposes, categories of personal data and existence of automated decision-making referred to in Article 22. Some drivers also requested portability within the meaning of Article 20.
Uber argued among other things that the qualification as personal data depended on whether the information in question was or not intended for internal consultation and deliberation.
Holding
The Court first assessed the admissibility of the incidental appeals under national law.
Then, it assessed each request to determine if they fell into the scope of Article 15(1). Its assessment can be summarized as follows.
For the access to the driver's profile i.e. a note that Uber employees use to transfer customer service requests from drivers to other Uber employees, the Court referred to the CJEU Nowak case and considered that it contains a representation of the driver's specific request. The driver's profile constituted personal data and therefore falls within the scope of Article 15(1).
Concerning access to the tags, the Court stated that it contained information about the relevant driver and therefore also falled within the scope of Article 15(1).
Regarding the reports per journey and the individual ratings, they are both based on feedback by passengers about the relevant driver. Uber had already provided excel documents with anonymized passenger feedback about drivers, taking into account the right of the passengers to not be traced back from their rating or comments. The Court held that the drivers did not have a sufficient interest to access to all reports without restrictions.
For the information about recipients, the Court referred to the CJEU Österreichische Post case in which the CJEU ruled that the information provided to the data subject under the right of access under Article 15(1)(c) should be as accurate as possible.
Concerning information about automated decision making, the Court firstly analysed the scope of Article 15(1)(h) and noted that the Dutch version of that article is not entirely clear. After comparing it with other language versions, it stated that the right of access contained in Article 15(1)(h) only relates to the form of automated decision making referred to in Article 22(1) to (4). This implied that under Article 15(1)(h), there is a right to information insofar as the controller subjects the data subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects them. In this cases, 5 categories of automated decision making were distinguished and assessed :
- The batched matching system (automated system which links drivers to passengers) determines the amount of work of the drivers and therefore their income and therefore produces legal effects on the drivers.
- The upfront pricing system (automated system that calculates the price for a ride in advance based on various factors) has financial consequences and determines the income of the drivers. It therefore also produces legal effects.
- The average rating of drivers can form grounds to deactivate drivers and therefore have significant effects on them.
- Concerning the cancellation costs and deactivation of driver's account, the Court considered that the drivers failed to explain their arguments.
For the batched matching system, upfront pricing system and average rating, the Court considered that these decisions are made solely on automated processing. It considered that Uber could not rely on an exception in that regard. Uber therefore wrongly rejected the requests for information regarding these three types of automated decisions. It should have provided the drivers with general information and in particular information on factors that influence the decision-making process.
Concerning the right to portability referred to in Article 20, the Court concluded that the requests based on Article 20 concerned data that were not eligible for allocation and rejected that request.
The Court decided to order Uber, within two months, to grant the requests to access information under Article 15(1), including driver's profiles, information about upfront pricing, batched matching system and average ratings. This order is subject to a penalty payment of €4,000 for each day Uber fails to comply.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
