What Uber's algorithmic management actually involved
Uber's driver management system used AI extensively: to match drivers with rides, to set pricing dynamically, to evaluate driver performance through a rating system, to identify drivers for deactivation based on acceptance rates and other metrics, and to manage communications with drivers. The system made consequential decisions — including permanent account deactivation, which ended drivers' ability to earn income — through automated processes with limited human involvement and even more limited transparency for the drivers affected.
The drivers who challenged Uber's algorithmic management argued that they had no meaningful ability to understand why decisions were made about them, no access to the data used to make those decisions, and no practical mechanism to contest decisions they believed were wrong. These arguments were legally well-founded: GDPR Article 22 gives individuals the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. An automated deactivation decision that ends a driver's income clearly produces a significant effect.
The Dutch DPA enforcement action: what the regulator found
The Dutch Data Protection Authority's 2023 enforcement action against Uber found multiple GDPR violations related to automated decision-making. Uber's automated decision-making on driver deactivation did not meet the transparency requirements — drivers were not given meaningful information about the logic of the decisions affecting them. The procedures for requesting human review were inadequate — they did not provide genuinely independent human assessment of automated decisions. And the data protection impact assessment for the automated decision-making systems was insufficient.
The DPA's finding that Uber's review mechanisms were inadequate is particularly important for organisations designing AI governance. Uber did have a process for drivers to appeal deactivation decisions. The problem was that the appeal process involved a review of the automated decision by staff who used the same data and the same system — it was not genuinely independent human review, and it did not meaningfully allow drivers to present information that could change the outcome. This is the nominal versus genuine human oversight distinction that regulators are applying across jurisdictions.
Lessons for enterprise AI workforce management
The Uber enforcement actions are not specific to the gig economy. Any organisation that uses AI to evaluate employee performance, make decisions about task allocation, monitor worker activity, or contribute to employment decisions — promotion, disciplinary action, termination — is subject to the same legal framework that Uber violated. The specific lessons: automated decisions with significant employment consequences require genuine human review, not nominal approval of an automated outcome. Workers must have access to the data and logic used in decisions about them. Grievance mechanisms must provide meaningful recourse, not just a process that concludes with the same automated result.
