The Article 22 Test, One Condition at a Time
Uber’s reported driver deactivation is now a legal classification problem. The key question is whether the software-driven account change satisfies the three cumulative conditions in Article 22 of the GDPR. Working through those conditions one at a time lets us distinguish what the regulators’ evidence strongly supports from what a complete enforcement record or court ruling would still need to establish.
The order matters. It is easy to begin with a conclusion—“an algorithm made the decision”—but Article 22 does not regulate every use of software in the same way. It asks what outcome occurred, how the outcome was produced, and how seriously it affected the person. Only after those questions are connected does it make sense to discuss exceptions or safeguards.
Article 22 has three cumulative conditions
Article 22(1) says that a person has the right not to be subject to a decision based solely on automated processing, including profiling, when the decision produces legal effects concerning that person or similarly significantly affects them. In ordinary language, the rule is concerned with a decision that is made by automation alone and that matters greatly to the individual.
Three ideas are doing the work in that sentence.
The first is a decision. The GDPR does not define the word narrowly as a signed order, a contract termination, or an action taken by a person with a formal title. In its SCHUFA judgment, the Court of Justice of the European Union said that the concept is broad enough to include the result of calculating a person’s creditworthiness as a probability value. The Court relied on the language of Article 22 and its surrounding recital, which refers to measures that produce legal effects or similarly significant effects. An outcome can therefore be a decision even when it is produced inside a technical or commercial process rather than announced as a legal ruling.
The second is solely automated processing. Processing is automated when software performs the relevant evaluation or action without a person meaningfully participating in that decision. Article 22 expressly includes profiling, a term that covers automated use of personal data to evaluate aspects of a natural person, such as reliability, behaviour, or economic situation. The rule is not limited to sophisticated artificial intelligence. A simple rule can be consequential if it automatically determines what happens to an individual.
The word “solely” is important because it focuses attention on the role of human judgment. A system may collect information automatically and then present it to a person who independently decides what to do. That is different from a system in which the software’s output directly produces the consequence. The existence of an employee somewhere in the wider organization is not enough to answer the question. The relevant issue is whether a person had a meaningful role in the individual decision at the point when the outcome was determined.
The third is a legal effect or a similarly significant effect. A legal effect might change someone’s legal position or rights. The alternative category is broader: an outcome can fall within Article 22 when it affects a person in a comparably serious practical way, even if the effect is not expressed as a formal legal change. The CJEU illustrated this in SCHUFA. A credit score did not itself sign a loan contract, but the referring court found that an insufficient score led in almost all cases to a bank refusing the loan. That practical influence was enough for the Court to say that the score affected the person significantly.
These conditions are cumulative. A system can use automation without making a decision. A decision can be automated without affecting someone seriously. A serious outcome can involve software while still being shaped by a person. Article 22(1) is engaged when the three characteristics meet in the same process. This does not mean that a process outside Article 22 is unregulated; other GDPR duties and other legal rules may still apply. It means that the specific Article 22 prohibition cannot be applied by skipping one of its elements.
The conditions also describe different layers of one event. The decision question asks what the system produced: an account block, a recommendation, a ranking, or something else. The sole-automation question asks who or what actually determined that result. The effect question asks what the result did to the individual. A system might produce an internal alert that a person independently evaluates; that can involve automated processing without the alert itself being the final decision. Another system might automatically close a person’s account; that outcome is harder to describe as mere analysis, even if the rule that caused it is simple.
The word “profiling” should be handled with similar care. Article 22 covers automated processing generally and expressly includes profiling. Profiling is relevant when personal data are used to evaluate aspects of a person, such as behaviour or reliability. The reported Uber process used personal information about driving behaviour and customer reviews to trigger account actions, so it has features that may be consistent with an evaluation of the driver. But the releases do not describe a formal profile, a score, or the AP’s exact use of the term. The Article 22 analysis does not need us to invent those details. The stronger evidence is that automated processing itself produced the account outcome.
Nor does the purpose of an automated process settle the effect question. Fraud prevention may be a legitimate operational aim, and customer feedback may be relevant to platform quality. But a legitimate aim does not make the consequence immaterial. The same purpose can be pursued through data collection, a warning, a human investigation, or an automatic exclusion. Article 22 asks about the decision and its effect on the person, not only about the organization’s reason for building the process.
The structure can be represented as a diagnostic path:
This path is not a substitute for legal reasoning. It is a way to keep distinct questions from collapsing into one another. Calling something an algorithm does not prove that it is a decision. Calling something a status change does not prove that it is insignificant. And showing that a person exists in the organization does not prove that the person influenced the outcome.
The path must also be applied to the same individual outcome, not to the system in the abstract. It would be possible for one Uber tool to generate low-rating information, for a separate employee to use that information in some cases, and for another automated route to deactivate accounts in others. Evidence about one route would not automatically describe every route. The AP’s summary gives a strong statement about the deactivations it investigated, but it does not license a broader claim about every piece of software Uber used or every decision involving a driver.
That is why the legal analysis follows the account action rather than the existence of a rating. A rating can be input. A software classification can be an intermediate result. The Article 22 question becomes acute when the process takes that information and makes the driver’s access change without a human assessment. The object of analysis is the link between the classification and the consequence: how direct it was, who controlled it, and whether the driver had a meaningful chance to affect it before losing access.
How the reported Uber facts fit the test
The first condition—whether there was a decision—has unusually strong support in the Uber material because both the AP and the CNIL describe the account deactivations as automated individual decisions. Their wording is not incidental. The action they identify is not merely the collection of a review or the generation of an internal alert. It is the temporary or permanent change to a driver’s account.
That account change has the features of a decision in practical terms. Before the change, the driver could use the platform to make rides. After the change, the driver could not do so, according to the CNIL. The process therefore produced an outcome about a particular person and attached a consequence to that outcome. Whether the platform stored the result as a flag, a hold, or an account status does not settle the classification. The effect of the state change is more important than the field name used to represent it.
The second condition—solely automated processing—is also directly supported by the AP’s account, subject to a precise reading of what it says. The AP reports that Uber’s software tracked driving behaviour and customer reviews, and that an account was automatically deactivated when the software detected a suspicion of fraud or low customer ratings. It further says there was no human assessment before the account action.
That is evidence of an absent human checkpoint in the reported decision path. It is not evidence that no Uber employee ever communicated with a driver, reviewed a complaint, or restored an account later. Those are different points in time and would serve different functions. Article 22’s question at this stage is whether a human assessed the individual outcome before the software-driven account action took effect. On the regulator’s description, the answer was no.
This timing also answers a possible attempt to narrow the event. One might describe the software as only applying a policy that was designed by people, or say that people remained responsible for the policy in a broad organizational sense. Those statements would not show that a person assessed the particular driver’s case. A rule can be human-authored and still operate as solely automated when it determines the individual outcome without human intervention. Conversely, a human-designed system is not automatically solely automated if an assessor genuinely weighs the result and can change it before the consequence.
The third condition—serious effect—is supported by the consequence rather than by the technical input. The CNIL says that a blocked driver can no longer make rides or generate revenue. The AP says income through Uber was lost during deactivation and describes the result as immediate. The evidence does not quantify every driver’s loss, and it does not say that all drivers depended on Uber in exactly the same way. It does show why the regulators regarded the decisions as significant: the account state removed access to a source of work and income.
This is an important shift in perspective. The initiating information may look ordinary. A customer rating is familiar. A suspicion of fraud is a classification rather than a proven finding. But Article 22 does not ask only whether the input was ordinary. It asks what the processing did to the person. When the classification automatically controls access to rides, the consequence is no longer confined to data analysis.
On the available record, Uber’s reported process therefore fits the Article 22 model strongly enough to justify the regulators’ characterization. There is a person-specific account outcome, the AP reports that software produced it without human assessment, and both authorities connect it to a substantial loss of practical access and income. The conclusion should still be stated carefully. The releases are summaries, not the complete administrative decision, and the AP’s announced fine has been appealed. The evidence supports a strong Article 22 concern and a regulator finding; it does not give us a final judicial determination of every legal issue.
The distinction between “legal effect” and “similarly significant effect” should also remain visible. The sources do not provide a court’s detailed analysis of whether driver deactivation changed a legal position in the strict sense. They do provide direct evidence of a serious occupational and economic effect. That is why the significant-effect branch is the better-supported route in this record. It avoids pretending that a legal conclusion has been proved when the practical consequence already explains the concern.
This is not a way of lowering the legal threshold to any inconvenience. The effect must be significant, and significance depends on the consequence in context. Losing access to an income-generating platform is materially different from seeing an internal recommendation, waiting a few seconds for a page to load, or receiving an ordinary marketing message. The sources support the first description because they connect the block to the inability to make rides and earn revenue. They do not establish a universal rule that every account warning, rating, or temporary service interruption will meet the same standard.
The CJEU’s SCHUFA reasoning reinforces this approach without deciding Uber’s case. In SCHUFA, the Court refused to treat an automated probability value as legally irrelevant merely because a bank made the formal credit decision afterward. The score’s practical influence mattered. Uber’s described system is different: the releases portray the platform’s software as directly producing the account deactivation, not as supplying a score to an independent downstream decision-maker. The shared lesson is narrower and more useful. Legal analysis should follow the practical role of the automated output to the point where it changes the person’s circumstances.
That comparison also shows why a legal classification is not the same as a judgment about whether the underlying policy is wise. A platform may have reasons to investigate fraud or respond to poor customer experiences. Article 22 does not require us to decide, at this stage, whether those aims are commercially sensible. It asks whether the method used to reach an individualized, serious outcome falls within the rule. Separating purpose from method and method from effect makes the conclusion more precise: the concern arises from the automated route to deactivation, not from the mere existence of fraud controls or customer ratings.
Several questions remain open. The releases do not show the precise rating threshold, the indicators used to detect suspected fraud, the data used to evaluate a driver, or the error rate. They do not explain whether a driver could contest a trigger before deactivation, how long a temporary block lasted, or how a permanent block could be challenged. They do not reproduce the AP’s full reasoning about Article 22, the information given to drivers, or the legal basis Uber invoked.
Those gaps do not cancel the three-condition analysis. They define its limits. More detailed system records could change our understanding of how often the pathways occurred, how accurate the classifications were, or whether different drivers experienced different outcomes. A full decision could clarify the authority’s treatment of legal effect, significant effect, profiling, and any Article 22 exception. Evidence of a genuine pre-action review could change the assessment of sole automation. Conversely, records showing that a nominal review could not alter the result would strengthen the conclusion that the process remained automated in substance.
For now, the test identifies the relevant legal boundary. The Article 22 question is raised not because Uber used software in the abstract, but because the reported software-linked process made individualized account decisions, did so without human assessment, and removed drivers’ ability to make rides and earn platform income. The next issue is what Article 22 permits once that boundary has been crossed—and whether any exception can operate without the safeguards that make human intervention real.