March 2021 - the Netherlands - UBER BV / Uber drivers (data protection)

ECLI:NL:RBAMS:2021:1020

Ruling on March 11, 2021

Authority: Cantonial Court Amsterdam

Parties: Uber-drivers/Uber

Subject: General Data Protection Regulation. Processing of personal data. Automated decision-making via an algorithm. 

Summary of facts: Uber is an international company which offers online services in the transport sector through matching passengers and drivers. Multiple drivers have requested Uber to give access to their personal data which is processed by the app. Upon that request Uber did provide a couple digital files to the drivers. However, the drivers deem the information provides insufficient insight into all the personal data the company processes. That is the reason why the drivers submitted a data subject access request at court. The drivers address the court with the request to order Uber to provide insight into the personal data which it has processed.

Legal question: Is Uber obliged to grant the drivers access to all personal data, or to specific personal data, it has processed?

Considerations: There is no abuse of law. The persons concerned do not need to offer special reasons as to why they request insight into their personal data. The drivers claim they want to verify the correctness and the lawfulness of the data. That is a good enough reason. The court finds the request to grant the drivers access to all personal data Uber has processed too generic. Uber is allowed to ask for further specification. With regard to the information request concerning specifically mentioned categories the court decides as follows. Uber must provide insight into the anonymized personal data linked to the ratings. It has to make sure that the data is not traceable to particular passengers. All other information request (re Guidance Notes, Driver’s Profile, Tags, reports based on feedback of passengers, start and end location of a ride, driving behaviour, upfront pricing-system) are denied either because the request is insufficiently precise or violates the privacy rights of passengers. The request to transfer the personal data in a certain format is denied. The right of data portability in the GDPR does not entail the right to receive the data in a specific format.

Ruling: Uber must provide insight into the anonymized personal data linked to the ratings. All other information requests are denied either because the request is generic or violates the privacy rights of passengers. The right of data portability in the GDPR does not entail the right to receive the data in a specific format.