Overview

Article 22’s prohibition in principle can give way through three routes: contract necessity, Union or Member State law with suitable safeguards, or explicit consent. For Uber, the public summaries do not identify a relied-on exception, and a driver agreement, general privacy notice, or lawful data-collection purpose is not enough by itself. Even an applicable route leaves duties to provide safeguards, information, a point of view, contest, and—under the GDPR more broadly—lawful, fair, accurate, necessary, and accountable processing. The CJEU’s SCHUFA judgment also links Article 22 exceptions to Articles 5 and 6. The article maps these conditions without resolving Uber’s full legal basis or appealed fine.

Learning outcomes

Article 22 exceptions are conditional routes: contract necessity, authorizing law plus safeguards, or explicit consent.
A lawful basis to process Uber driver data or a driver contract does not by itself authorize automated deactivation.
Permitted automation still requires applicable safeguards and surrounding GDPR duties, including information and contestability.

Keywords

UberArticle 22exceptionsconsentsafeguardslawfulness

What Article 22 Allows—and What It Still Requires

The reported Uber deactivations have crossed the threshold at which Article 22 must be analyzed, but crossing that threshold does not answer every legal question. The subject now is the space between Article 22’s prohibition and its exceptions: when may a consequential decision be automated, and what protections must remain in place? Understanding that structure lets us judge a platform’s claimed legal basis without treating a contract, a consent box, or a general policy as a free pass.

An exception is a route with conditions, not a waiver

Article 22(1) starts with protection against a decision based solely on automated processing, including profiling, when the decision has legal effects or similarly significantly affects the person. The CJEU describes this as a prohibition in principle. Article 22(2) then identifies three situations in which paragraph 1 does not apply in the same way:

the decision is necessary for entering into or performing a contract between the person and a controller;
Union or Member State law authorizes the decision and also lays down suitable measures to safeguard the person’s rights, freedoms, and legitimate interests; or
the decision is based on the person’s explicit consent.

Each route has its own factual predicate. The first does not say that any decision connected with a contract is permitted. It says the automated decision must be necessary for entering into or performing that contract. A platform relationship may explain why Uber wants to monitor conduct or protect users, but the existence of a driver agreement does not by itself prove that automatic deactivation was necessary to perform it. Necessity asks about the connection between the contractual objective and the automated method, not merely whether both appear in the same business relationship.

The second route is more demanding than pointing to a general rule that allows data processing. Union or Member State law must authorize the automated individual decision and provide suitable safeguards. In the SCHUFA judgment, the CJEU stressed that a national legal basis under Article 22(2)(b) must protect the data subject rather than simply approve profiling in broad terms. A law that mentions scoring or permits the use of information may not answer whether it authorizes the decision-producing activity itself or whether it provides the safeguards Article 22 requires.

The third route requires explicit consent from the data subject. Explicit consent is not the same as a person agreeing to general terms, allowing ordinary data processing, or clicking through a service registration. The consent must relate to the automated decision in the way Article 22 requires. The available Uber summaries do not say that drivers gave such consent, and they do not identify which exception Uber relied on. It would therefore be unsafe to assume that the platform’s contractual documents or general privacy notices resolved the Article 22 issue.

The exceptions also do not eliminate the need for protection. Article 22(3) states that, in the contract and explicit-consent cases, the controller must implement suitable measures to safeguard the person’s rights and interests.

Published by DeepMox

FAQ

Is a driver contract enough to permit Uber’s automated deactivation?

No. The Article 22 contract route requires the automated decision to be necessary for entering into or performing the contract; a contractual relationship alone does not establish that necessity.

Does explicit consent mean accepting Uber’s general terms?

No. Article 22 requires explicit consent to the automated decision itself; general terms, ordinary data-processing permission, or service registration are not automatically equivalent.

Do an Article 22 exception and lawful processing end the other GDPR duties?

No. An exception does not replace Articles 5 and 6 or the applicable information, access, safeguard, and contestability duties; the CJEU made that point in SCHUFA.

Previous7 minUber Article 22: Is Human Review Real?

Next10 minUber: Designing Meaningful Human Intervention

Uber Deactivation: Article 22 Exceptions and Safeguards

What Article 22 Allows—and What It Still Requires

An exception is a route with conditions, not a waiver

FAQ