{"id":2597,"date":"2021-04-29T15:07:44","date_gmt":"2021-04-29T15:07:44","guid":{"rendered":"http:\/\/www.sectorplandls.nl\/wordpress\/?page_id=2597"},"modified":"2021-04-29T15:37:56","modified_gmt":"2021-04-29T15:37:56","slug":"the-ola-uber-judgments","status":"publish","type":"page","link":"https:\/\/www.sectorplandls.nl\/wordpress\/blog\/the-ola-uber-judgments\/","title":{"rendered":"The Ola & Uber judgments"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\n\t\t\t\n\t\t\t\t\t\t
\n\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\n\t\t\t\t\t\t\tApril 2021\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\t\t\t\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The Ola & Uber judgments: for the first time a court recognises a GDPR right to an explanation for algorithmic decision-making<\/span><\/span><\/div><\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
Photo credit: Getty Images<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tRapha\u00ebl Gellert<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tDigital Legal Lab & Radboud University Nijmegen<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t
Marvin van Bekkum<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t
Radboud University Nijmegen<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tFrederik Zuiderveen Borgesius<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tDigital Legal Lab & Radboud University Nijmegen<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In March 2021, the Amsterdam District Court decided in two cases regarding Uber (\u2018Uber employment<\/a><\/strong>\u2019 and \u2018Uber deactivation<\/a><\/strong>\u2019 cases), and one case regarding Ola<\/a><\/strong> (see also the unofficial English translations<\/a><\/strong> of the judgments). Ola offers a service that\u2019s comparable to Uber. Both companies offer an app that links (taxi) drivers to passengers.<\/p>

In the Ola judgment, the Court requires the Ola company to explain the logic behind a fully automated decision in the sense of article 22<\/a><\/strong> of the General Data Protection regulation<\/a><\/strong> (GDPR). This is the first time that a court in the Netherlands recognises such a right. To the best of our knowledge, it is also the first time that a Court anywhere in Europe recognises such a right.<\/p>

In this blog post we sketch the background of the three cases, we summarise the relevant part of the judgments, and we comment on the judgments. We focus only on the parts of the judgment about fully automated decisions and a right to an explanation.<\/p>

Background of the case: the GDPR and a right to an explanation<\/h4>

The GDPR contains a specific provision that in principle prohibits a fully automated decision with \u2018legal effects\u2019 for the data subject (individual), or that \u2018similarly significantly affects him or her\u2019 (article 22 GDPR). An example of a fully automated decision is, for example, automated credit scoring. The main rule of the prohibition says, in essence, that people may not be subjected to certain types of completely automated decisions with far-reaching effects, unless an exception applies.<\/p>

The prohibition does not apply if the individual has consented to such decisions, or if such decisions are \u2018necessary\u2019 for entering into, or performing, a contract between the individual and the company.<\/p>

If such an exception applies, the automated decision is allowed. Article 15<\/a> <\/strong>GDPR grants people the right to learn \u2018meaningful information about the logic involved\u2019 in such fully automated decisions. Some scholars<\/strong><\/a> speak of a \u2018right to an explanation\u2019 of AI-driven decisions. Article 15 also grants people a right to access their data. In short, people can ask an organisation what data the organisation has about them, for which purpose, etc.<\/p>

Summary of the Ola and Uber judgments: access to data<\/h4>

We start by summarising the similarities between the Ola and Uber employment cases. In both judgments, drivers wanted to prove that they were subject to an employment relationship with Ola and Uber. To prove their employment relationship, the drivers requested access to their data under article 15 GDPR (par. 2.5 Ola judgment, par. 2.7-2.8 Uber employment case).<\/p>

The drivers further state that the degree of algorithmic and automated management control is important for proving an employment relationship (par. 3.6 of the Ola judgment). A key element of the judgments was therefore whether such \u2018algorithms and automated decision-making\u2019 fall under the scope of article 22 GDPR. If article 22 applied, the drivers would also be able to access \u2018meaningful information about the logic involved\u2019 in these algorithms (par. 3.1 Ola judgment, par. 3.1 Uber employment judgment).<\/p>

In both cases, the issue at stake was whether the algorithms and automated decision-making had \u2018legal effects\u2019 or did \u2018similarly significantly affect\u2019 the drivers in the sense of article 22 GDPR.<\/p>

In the Uber employment case, the Court examined the algorithm-mediated matching of passengers and drivers. In the Court\u2019s view, the drivers did not adequately motivate why there was a \u2018legal\u2019 or \u2018significant effect\u2019 in article 22 GDPR (par. 4.66 and 4.67 Uber employment judgment).<\/p>

In the Ola case, the Court looked at various algorithms and automated decision-making processes such as those pertaining to the drivers\u2019 earning profile, the system of irregularities detection, and the system for assigning trips. In the Court\u2019s view, the drivers did not prove that these systems had a \u2018legal\u2019 or \u2018similarly significant effect\u2019, despite the systems having some effect on the driver\u2019s behaviour (par. 4.47-4.50 Ola judgment).<\/p>

The situation is different concerning Ola\u2019s automated system of \u2018penalties and deductions\u2019 (par. 4.51 of the Ola judgment). If a certain ride was considered invalid, then Ola\u2019s computer systems would give the driver a monetary penalty. The Court considered that such penalties \u2018similarly significantly affects\u2019 the driver. The penalties were significant because they affected the rights of the drivers resulting from the drivers\u2019 agreement with Ola. Therefore, the Court required Ola to explain the logic behind such decisions on the basis of article 15 GDPR.<\/p>

In the words of the Court, \u2018Ola must communicate the main assessment criteria and their role in the automated decision to [the drivers], so that they can understand the criteria on the basis of which the decisions were taken and they are able to check the correctness and lawfulness of the data processing\u2019 (par. 4.52 of the judgment).<\/p>

Summary of the Uber deactivation judgment<\/h4>

In the other Uber deactivation case, the drivers were contesting the removal of their Uber license pursuant to an automated decision (par. 2.4, 3.1, 3.2 Uber deactivation judgment). As part of this contestation, the drivers also requested access to meaningful information about the logic involved in the automated decision pursuant to article 15 GDPR (par. 3.1 Uber deactivation judgment).<\/p>

Contrary to the other cases, the discussion here concerned mostly whether the automated decision was \u2018solely\u2019 (or fully) automated in the sense of article 22 GDPR. Uber explained that an \u2018Operational Risk team\u2019 takes the decision to end the licenses on the basis of the potential fraud signal it receives from Uber\u2019s automated algorithm (par. 4.19 Uber deactivation judgment).<\/p>

In Dutch Civil procedure law, a statement by one party that is not contested by the opposing party is considered proven. The Court accepted Uber\u2019s explanation because the drivers did not contest the explanation. The Court therefore concluded that there were no fully automated decisions (par. 4.24 Uber deactivation judgment). The Court consequently denied the drivers a right to access to meaningful information concerning the algorithm pursuant to article 15 GDPR (par. 4.26 Uber deactivation judgment).<\/p>

Comments<\/h4>

In the Ola case, for the first time, a Court requires an organisation to explain the logic behind a fully automated decision in the sense of the GDPR. Many scholars<\/a> <\/strong>(including us) thought that the GDPR provisions on automated decision-making and a right to an explanation would remain a dead letter. The predecessors of those provisions (in the 1995 Data Protection Directive) have not been applied much either.<\/p>

However, this recent Ola judgment shows that Courts can actually apply these GDPR provisions in practice. Hence, the judgment gives an extra reason for organisations to take the GDPR provisions on automated decision-making seriously. Therefore, organisations that use fully automated decision-making that seriously affects people must be able to explain the logic behind such decisions.<\/p>

In the Ola judgment the Court elaborates the term \u2018meaningful information\u2019. The Court builds on the \u2018Guidelines on Automated individual decision-making and Profiling<\/a><\/strong>\u2019, adopted by the Article 29 Working Party, the predecessor of the European Data Protection Board.<\/p>

The Court interprets \u2018useful information about the underlying logic\u2019 in such a way that the most important assessment criteria and their role must be communicated to the data subject. Based on that information, the data subject should be able to understand which criteria the decision is based on. The data subject should also be able to verify the correctness and lawfulness of the data processing based on the given information (para 4.41 Ola judgment).<\/p>

If a decision is automated in the sense of article 22 GDPR and an exception applies that allows that automated decision, then another requirement follows. Article 22(3) GDPR states that the organisation must \u2018implement suitable measures to safeguard the data subject\u2019s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.\u2019<\/p>

Roughly summarised, the organisation must ensure that the victim of a fully automated decision can ask a human to reconsider the decision. For instance, if a bank uses a computer to decide whether a customer gets a mortgage, the customer must be able to ask a bank employee to reconsider the decision. Because the Court ruled that Ola used automated decision making in some cases, Ola probably needs to implement a system that allows human intervention.<\/p>

GDPR is about more than privacy<\/h4>

The Ola judgment illustrates that the GDPR does not only aim to protect privacy. Rather, the GDPR aims for fairness in general, in situations where organisations use personal data. For instance, the GDPR also aims to mitigate the risk of discrimination. Indeed, in the Uber employment case, the Court stated that the GDPR is key to avoid \u2018the discriminatory consequences of profiling\u2019 (par. 3.3 Uber employment case). In the cases at stake, the drivers used the GDPR to contest the unfairness of a license-removal decision and to expose the power that platform economy apps have over drivers.\u00a0<\/p>

The Dutch judgments discussed above are all from Courts of first instance. Hence, parties may still appeal the judgments.<\/p>

Open questions<\/h4>

There are still many open questions about the GDPR\u2019s provisions regarding fully automated decisions and a right to an explanation. For instance, article 22 GDPR applies to decisions \u2018based solely on automated processing\u2019. It is debatable to what extent the GDPR\u2019s provision applies to decisions that are largely, rather than \u2018solely\u2019, based on automated processing. In the Uber deactivation case, a whole team took the decisions, so the case was clear-cut: the decisions were not automated.<\/p>

Arguably, article 22 does not apply if a bank employee denies a loan on the basis of a recommendation by an AI system. It would be useful if case law made clearer where the border lies between, on the one hand, fully automated decisions, and on the other hand, partly automated decisions that remain outside the scope of article 22 of the GDPR. The European Data Protection Board says<\/a><\/strong> (at p 21) that an automated decision counts as a fully automated decision, if employees rubberstamp automated decisions.\u00a0<\/p>

More clarity is also needed on what constitutes as a sufficient explanation under the GDPR. For many AI-driven decisions, it is difficult to explain the underlying logic. Explaining a decision can be especially difficult when an AI system arrives at that decision after analysing large amounts of data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This blog post was originally published by EU Law Analysis. View the original publication here<\/a><\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

April 2021 The Ola & Uber judgments: for the first time a court recognises a GDPR right to an explanation […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":836,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"no-sidebar","site-content-layout":"page-builder","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"disabled","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-2597","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.sectorplandls.nl\/wordpress\/wp-json\/wp\/v2\/pages\/2597","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sectorplandls.nl\/wordpress\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.sectorplandls.nl\/wordpress\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.sectorplandls.nl\/wordpress\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sectorplandls.nl\/wordpress\/wp-json\/wp\/v2\/comments?post=2597"}],"version-history":[{"count":7,"href":"https:\/\/www.sectorplandls.nl\/wordpress\/wp-json\/wp\/v2\/pages\/2597\/revisions"}],"predecessor-version":[{"id":2609,"href":"https:\/\/www.sectorplandls.nl\/wordpress\/wp-json\/wp\/v2\/pages\/2597\/revisions\/2609"}],"up":[{"embeddable":true,"href":"https:\/\/www.sectorplandls.nl\/wordpress\/wp-json\/wp\/v2\/pages\/836"}],"wp:attachment":[{"href":"https:\/\/www.sectorplandls.nl\/wordpress\/wp-json\/wp\/v2\/media?parent=2597"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}