Uber Allegedly Violated GDPR by Failing to Provide Sufficient Notice on Automated Profiling for Drivers

Uber was alleged in a lawsuit to have provided incomplete notice about automated decision-making and profiling for drivers such as information about their driving behavior, and use of phone.

Risk classification

• Primary risk domain: 5 Human-Computer Interaction
• Primary risk subdomain: 5.2 Loss of human agency and autonomy

Uber delegated key employment decisions, including account terminations, to automated systems with no meaningful human review or appeal route, removing human agency.

Additional risk subdomains

• 7.4 Lack of transparency or interpretability: Uber's algorithmic management systems operated as black boxes, withholding critical profiling data and decision logic from drivers.
• 6.2 Increased inequality and decline in employment quality: The use of automated 'robo-firings' and opaque dynamic pricing structures degraded working conditions and increased the power imbalance between the platform and workers.

Causal factors

• Entity: AI
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by Uber's intentional deployment of automated decision-making and profiling algorithms to manage and terminate drivers post-deployment.

EU AI Act risk tier

• Risk tier: 2 High Risk

Risk Level 2: High Risk. The system is an employment and worker management system used for monitoring, evaluating, and terminating workers, which is classified as high-risk under the EU AI Act.

AI system and alleged parties

• AI system: Uber Driver App dispatch and compensation system
• AI purpose: Workforce Monitoring and Evaluation; Workforce Administration
• Behaviour type: Autonomous
• Alleged developer: Uber
• Alleged deployer: Uber
• Alleged harmed parties: Uber drivers

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Minor, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Minor, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report explicitly describes financial losses resulting from drivers being deactivated and losing their livelihoods, though specific monetary amounts are not quantified.

Directly caused: The 4 deactivated drivers suffered complete loss of their primary source of income due to automated terminations.

Inferred additional harm: We infer substantial cumulative financial losses, potentially in the millions of dollars, for thousands of gig workers across the UK and EU who were wrongfully deactivated or received lower earnings due to opaque algorithmic profiling.

Differential treatment

Reported: The report explicitly describes differential treatment, noting that drivers were subject to performance monitoring and profiling via electronic tags like 'attitude' and 'inappropriate behaviour'.

Directly caused: Claimant drivers were subjected to automated profiling and performance tagging which directly impacted their work allocation and account status.

Inferred additional harm: We infer that automated profiling systematically created unequal work opportunities and earning disparities among the broader pool of Uber drivers.

Civil rights

Reported: The report explicitly describes violations of human and civil rights, specifically GDPR data privacy rights and the right to meaningful human review of automated decisions.

Directly caused: Uber violated the GDPR rights of the claimant drivers by failing to provide access to their personal data and explanations of automated decision-making.

Inferred additional harm: We infer that systemic GDPR violations affected thousands of other platform workers whose data access requests were ignored or incomplete.

Privacy

Reported: The report explicitly describes privacy violations, specifically Uber's failure to comply with GDPR subject access requests regarding personal profiling data.

Directly caused: Uber failed to provide drivers with access to their personal data, including passenger ratings, fraud scores, and performance tags.

Inferred additional harm: We infer that Uber systematically withheld personal profiling data from its entire workforce of drivers in the UK and EU, violating their privacy rights at scale.

Psychological

Reported: The report explicitly describes psychological harm, noting that workers had their working lives and mental health destroyed by false claims of fraud and automated dismissals.

Directly caused: The sudden, unexplained automated deactivations and accusations of fraud directly caused severe stress and mental health struggles for the affected drivers.

Inferred additional harm: We infer that many of the thousands of other drivers subjected to sudden, unexplained robo-firings experienced significant anxiety, distress, and psychological trauma.

People affected

• Occurrences reported: 1
• People reportedly harmed: 10
• People reportedly exposed: 10

Potential causes

Management

• Information Power Asymmetry: Management exploits data control to suppress collective bargaining.
• Cost-Cutting Automation: Management automates HR to save money and avoid employer responsibilities.
• Abuse of Trade Secrets: Management uses proprietary claims to hide algorithmic control.

Technology

• Opaque Algorithmic Management: Algorithms control dispatch, pricing, and terminations without transparency.
• Automated Robo-Firing Systems: Algorithms automatically deactivate accounts based on suspected fraud.
• Dynamic Pricing Opacity: Personalized and dynamic pricing algorithms mask how pay is calculated.

Data Inputs

• Secret Performance Profiles: Drivers are profiled using hidden tags like attitude and cancellations.
• Incomplete Data Disclosure: Uber provides limited datasets, withholding fraud scores and ratings.
• Asymmetric Data Collection: Platforms harvest vast driver data while denying workers access to it.

Human Factors

• Lack of Meaningful Human Review: Staff perform symbolic checks rather than actual reviews of deactivations.
• Remote Decision Making: Remote staff in Krakow dismiss drivers without giving them a hearing.

Process and Methods

• Stonewalling and Obfuscation: Uber uses trade secrets defense to deny drivers access to algorithmic logic.
• Unjust Automated HR Processes: Platforms build automated HR systems with no humans in the loop.

Regulatory Environment

• Weak Enforcement of GDPR: Regulators fail to ensure swift platform compliance with data requests.
• Proposed Deregulation: UK draft bill threatens to strip workers of existing data protections.
• Inactive Oversight Bodies: Regulators like TfL fail to review changes to upfront pricing models.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide highly detailed legal and journalistic accounts of court filings, appeals court rulings, and statements from both the litigants and Uber. The facts regarding GDPR violations and automated deactivations are well-documented.
• Ambiguities identified: The exact technical inner workings of Uber's algorithms remain proprietary and opaque, which is the core of the dispute.
• Alternative interpretations: Uber argued that deactivations involved human review and were not purely automated, though the court found this human review to be merely symbolic.

A legal dispute over Uber's use of opaque algorithms for driver profiling and automated terminations in the UK and EU. While highlighting significant concerns regarding AI-driven labor management and GDPR compliance, the national security implications remain negligible to minor, with standard judicial mechanisms successfully addressing the issue.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: United Kingdom, Netherlands, Portugal, European Union
• Alleged perpetrator: Uber

Threat characteristics

• Imminence: Long-term. The incident represents a long-term regulatory and labor rights concern rather than an active, immediate security crisis.
• Autonomy: Human-supervised. The AI systems executed automated deactivations with minimal, symbolic human review, though humans retained ultimate system control.
• Novelty: Evolved capability. Represents an advancement in the scale and opacity of algorithmic workforce management and dynamic profiling.

Impact by dimension

• Physical security: Negligible. No physical threat, kinetic attacks, or critical infrastructure manipulation identified in the incident.
• Information security: Negligible. No espionage, intelligence compromise, or state-sponsored information operations occurred.
• Sovereignty: Negligible. The incident is a corporate labor and data privacy dispute handled through standard judicial channels.
• Economic security: Negligible. No strategic technology theft, financial system attacks, or critical supply chain disruptions occurred.
• Societal stability: Minor. Involves violations of GDPR privacy rights and automated profiling of workers, but impacts are managed within standard legal frameworks.