The Account Block Is the Decision
The subject of this series is Uber’s reported system for deactivating drivers’ accounts when software detected suspected fraud or low customer ratings. This opening focuses on the basic chain: what the platform does, who investigated it, what happened to drivers, and why European data-protection law treats that chain as more than an internal software event. The practical understanding to carry forward is simple but important: when a computer can stop someone from working, the name given to the action does not settle its legal significance.
An account block can look like a technical status change. It may appear in a database, an operations dashboard, or a message generated by a rules engine. But for the person whose account is blocked, the event is not confined to software. It can remove access to customers, trips, and income. That gap between the platform’s internal description and the driver’s practical reality is where the Article 22 question begins.
A platform, its drivers, and two regulators
Uber is described by the French data-protection authority, the CNIL, as a platform connecting private-hire-vehicle drivers with users. The case involves UBER B.V., located in Amsterdam, and UBER TECHNOLOGIES INC., based in San Francisco. Those corporate details matter because the system operated across borders, while the consequences were experienced by individual drivers who depended on access to the platform.
The complaint came from a human-rights organization rather than from an abstract debate about artificial intelligence. In 2020, La Ligue des droits de l’Homme brought a collective complaint to the CNIL on behalf of more than 170 drivers; the Dutch authority gives the more precise figure as 171 French drivers. The complaint was supplemented in 2021. It raised several issues, including information given to individuals, transfers of personal data outside the European Union, and automated decisions that could temporarily or permanently disconnect drivers from Uber.
The automated deactivation issue was therefore one part of a broader dispute about how the platform handled personal data and exercised control over drivers. That context helps explain why two regulators appear in the story. Because Uber’s European headquarters or main establishment was in the Netherlands, the Dutch Data Protection Authority—the Autoriteit Persoonsgegevens, or AP—was the authority that investigated the case. The CNIL cooperated with it by checking and analysing evidence and by examining the draft decision through the GDPR’s “one-stop-shop” procedure.
The one-stop-shop mechanism is meant to prevent a large cross-border organization from being assessed through disconnected national processes. One supervisory authority leads where the organization’s main establishment is located, while other concerned authorities participate when people in their jurisdictions are affected. Here, French drivers brought the complaint, the CNIL remained involved, and the Dutch AP conducted the investigation. The institutional path followed the platform’s corporate structure, but the subject remained the drivers’ loss of access to work.
That distinction is useful. The authority that leads an investigation is not necessarily the authority where every affected person lives, and the authority that receives a complaint is not necessarily the authority that ultimately issues the decision. Nor does cross-border cooperation turn a driver’s experience into an administrative abstraction. It connects a local consequence—being unable to accept rides—with the place where the platform’s relevant establishment and decision-making responsibilities are located. The case is about both sides of that relationship: the architecture of supervision and the practical power exercised over drivers.
The AP announced a fine of €824,990,000 for automated driver blocking. The CNIL described the same amount as a penalty imposed by the Dutch authority in cooperation with the CNIL. The AP also said that Uber had stopped the violations and had appealed the fine. That last fact sets an important boundary: the regulators’ announced findings are strong evidence of how the authorities characterized the conduct, but an announced penalty is not the same thing as an unchallengeable final court judgment.
The account-state change
The AP’s description gives the clearest outline of the reported process. Between 2018 and 2022, Uber used software to track drivers’ driving behaviour and customer reviews. When the software detected a suspicion of fraud, the driver’s account was automatically deactivated temporarily. Low customer reviews could also lead to temporary deactivation. When low reviews persisted, the consequence could become permanent deactivation.
The decisive point in the regulators’ description is not merely that Uber used software to sort or prioritize information. The AP says there was no human assessment of these account actions. The software did not simply alert a person who then made the consequential decision, at least as the authority describes the process. The trigger led to the account outcome without a human checking the individual case first.
This sequence turns the word “algorithm” into a concrete institutional action. Data about a driver’s behaviour or a customer’s assessment entered a software-controlled process. A suspicion or rating pattern then changed the driver’s account status. The immediate result, according to both regulators, was that a blocked driver could no longer make rides or generate revenue through Uber. The AP described the loss of income as occurring from one moment to the next.
That consequence is why the account block cannot be treated as a minor administrative inconvenience. A low rating may begin as one piece of information. A fraud suspicion may begin as a risk signal. But once either can automatically remove a driver’s access to rides, the platform has moved from evaluating information to changing the person’s practical ability to work. The action has a different meaning at the account boundary than it had at the moment the data was collected.
Temporary and permanent deactivation also show that the system was not producing one undifferentiated outcome. A temporary block interrupts access for a period; a permanent block changes the driver’s relationship with the platform more deeply. Persistent low ratings could move the process from the first state to the second. That progression matters because severity and duration shape the practical effect, even when the initiating input is described in modest terms such as a review or a suspicion.
From the driver’s point of view, the relevant event is the transition in access. The software may have been designed to detect patterns, but the account state determined whether the driver could participate in the marketplace. This is the point at which data processing becomes an exercise of platform control. It is also the point at which a meaningful check, if one exists, must be examined: before the trigger changes access, not only after the consequence has already reached the driver.
The available descriptions do not answer every operational question. They do not state the exact rating threshold, explain what counted as a fraud suspicion, identify the data used to produce the signal, or give the system’s error rate. They do not show whether drivers could challenge a trigger before deactivation, how quickly an account could be restored, or whether different categories of drivers were treated differently. Those are important questions, but their absence should not obscure what is established: the regulators describe automated monitoring, automated deactivation, no human assessment, and a direct loss of platform income.
Why the legal question starts with practical power
Article 22 of the GDPR protects a person from being subject to a decision based solely on automated processing, including profiling, when that decision produces legal effects or similarly significantly affects them. “Profiling” broadly means using personal data in an automated way to evaluate aspects of a person. Article 22 is not a rule that makes every algorithmic tool unlawful. It becomes relevant when an automated process has the character of a decision and its effect on the person is legally or practically serious.
The rule does not depend on whether the software is marketed as artificial intelligence. A simple set of if-then rules can be just as consequential as a statistical model if it automatically determines a person’s access to something important. Conversely, a system can process personal data without making the kind of decision Article 22 addresses. The analysis must therefore keep three questions connected: what outcome was produced, how exclusively did automation produce it, and how seriously did that outcome affect the individual. The detailed legal test comes later, but the opening distinction is already clear: technical complexity is not the measure of legal importance.
The reported Uber facts put all of those ideas in the same frame. The AP and the CNIL characterize the deactivations as automated individual decisions. The AP says the software made the account action without human assessment. The regulators connect the action to the driver’s inability to make rides and earn revenue. That does not by itself provide the complete reasoning of a court, but it explains why the authorities did not describe the event as a harmless recommendation or a back-office calculation.
This framing also prevents a common mistake: treating the data collection, the automated assessment, and the account consequence as separate events simply because different teams or systems may handle them. For Article 22, the relationship among those events matters. A review becomes important when it feeds a rule that can close an account; a fraud signal becomes important when it is allowed to produce that result without a person testing the individual circumstances. The legal question follows the chain to its effect on the driver rather than stopping at the first technical label.
The central issue is therefore not whether a person at Uber could, in theory, exist somewhere in the wider organization. It is whether a human had a real opportunity to examine and change the individual outcome before the account block took effect. A person who reviews an automated decision after income has already been cut off may serve an important remedy function, but that is different from a person who participates meaningfully in making the initial decision.
A later CJEU case involving SCHUFA helps sharpen this point, although it is not an Uber case. SCHUFA automatically calculated a probability value about a consumer’s ability to repay a loan, and banks relied strongly on that value. The Court held that the score-producing activity could itself be an Article 22 decision rather than merely a preparatory step. Treating it as only preparatory would have created a gap: the score provider held the logic and data, while the bank made the practical choice but did not possess all the information needed to explain the score.
The comparison matters because legal analysis can follow practical decision power across an organizational chain. A platform cannot necessarily avoid scrutiny by calling a consequential output a “flag,” a “risk score,” or an “account status.” At the same time, SCHUFA does not establish the facts of Uber’s case. The CJEU decided a dispute about credit scoring; the Uber releases describe a platform that directly deactivated driver accounts. The cases share a concern about automated power, but they are not interchangeable.
The best-supported opening conclusion is consequently narrower than “all automation is illegal” and more useful than “the computer only changed a status.” When software automatically moves a driver from access to work to temporary or permanent exclusion, when no human assessment occurs first, and when the result removes the ability to make rides and earn platform income, the action squarely raises the Article 22 question. The next step is to examine the account-state transition in more detail: exactly where does a data signal become a decision, and what would have to change before a human review could be called meaningful?