The use of automated decision-making has become increasingly embedded in the operation of digital platforms, from fraud detection and account monitoring to worker ratings, content moderation, and access decisions. Article 22 of the EU General Data Protection Regulation (GDPR) restricts decisions based solely on automated processing where they produce legal effects or similarly significantly affect an individual. In this blog post, we discuss the Uber decision issued by the Dutch Data Protection Supervisory Authority and examine how organisations can distinguish between automated processing that merely supports decision-making and automated processing that effectively makes the decision itself.
The Uber Decision
The Dutch Data Protection Authority’s decision to fine Uber €824.99 million on 21 August 2026 illustrates the regulatory consequences of failing to distinguish between supported decision-making and automated processing that makes the decision itself. The case concerned Uber’s use of automated systems between 2018 and 2022 to monitor driver behavior and customer ratings. These systems automatically suspended driver accounts and, in some cases, permanently deactivated accounts following consistently low ratings. As a result, the drivers received no income through Uber. The Dutch Data Protection Supervisory Authority found that there was no human assessment of the decisions.
The case originated from complaints submitted by 171 French Uber drivers through the Ligue des droits de l’Homme to the French Data Protection Supervisory Authority. The French authority referred the matter to the Dutch Data Protection Supervisory Authority as the lead supervisory authority under the GDPR’s one-stop-shop mechanism, given Uber’s European headquarters in the Netherlands.
Uber disputes the findings. It maintains that most suspensions are brief, that permanent deactivations involve human review, and that drivers have the ability to appeal. Uber has indicated that it intends to appeal the decision.
The decision nevertheless provides a useful lens through which to examine a question facing any organisation deploying consequential automated systems: what constitutes meaningful human intervention for the purposes of Article 22?
Article 22 and the Limits of “Human in the Loop”
Article 22 of the GDPR does not prohibit automated decision-making. It establishes a general right not to be subject to a decision based solely on automated processing where that decision produces legal effects or similarly significantly affects an individual, subject to the exceptions in Article 22(2).
The practical difficulty lies in determining when human involvement is sufficient for a decision to no longer be considered “solely automated”.
The phrase “human in the loop” is not, in itself, a legal safeguard. A human may review an automated recommendation, but such a review will only be relevant if it constitutes genuine participation in the decision-making process.
The CJEU’s decision in SCHUFA (C-634/21), together with the European Data Protection Broad’s guidance on automated individual decision-making, emphasises the importance of meaningful human involvement. Human intervention should be substantive rather than merely formal: the reviewer should have sufficient competence to assess the decision, genuine authority to depart from the automated outcome and the practical ability to do so.
This distinction is central to the regulatory concerns raised by the Uber decision.
What Constitutes Meaningful Human Intervention?
The GDPR does not require organisations to eliminate automated systems or obtain human approval for every automated assessment. The question is whether, where Article 22 applies, the human intervention is sufficiently substantive to amount to meaningful human involvement in the decision.
Drawing on WP29 guidance endorsed by the EDPB and on CJEU case law, factors that may be relevant in assessing whether human involvement is meaningful include whether the reviewer:
- has appropriate competence to understand and assess the basis for the automated outcome;1
- exercises independent judgment rather than simply confirming the system’s recommendation;
- has authority to change or overturn the outcome; and
- intervenes at a meaningful stage of the process, particularly where the automated outcome itself produces significant effect.2
A process may therefore contain a human reviewer without necessarily amounting to meaningful human intervention.
Does Article 22 Apply?
Article 22 analysis requires a sequence of questions.
- Is the Decision Based Solely on Automated Processing?
It is good to understand that not every automated system produces a decision within the meaning of Article 22.
Automated tools may identify risks, generate recommendations, or flag activity for further assessment by a human decision-maker. However, the fact that technology is involved does not, by itself, mean that the resulting decision is “solely automated”.
The critical question is whether there is meaningful human involvement in the decision itself.
- Does the Decision Have a Legal or Similarly Significant Effect?
The second question is whether the decision produces legal effects or significantly affects the individual.
The assessment is fact specific. A decision affecting a person’s ability to earn a living, access important services or continue participating in a platform may be capable of meeting this threshold, depending on the circumstances and the nature of the effect.
- Does an Article 22(2) Exception Apply?
Where the Article 22 prohibition is engaged, solely automated decision-making is permitted only in the circumstances specified in Article 22(2):
- where it is necessary for entering into or performing a contract;
- where it is authorised by Union or Member State law; or
- where it is based on the individual’s explicit consent.
- Are the Required Safeguards in Place?
Even where an Article 22(2) exception applies, Article 22(3) requires appropriate measures to safeguard the individual’s rights and freedoms.
These include the right to obtain human intervention, to express a point of view and to contest the decision.
An appeal mechanism may provide a right to contest a decision, but that does not necessarily resolve the separate requirement for human intervention. Where a significant consequence has already taken effect, a later opportunity to challenge the outcome is not necessarily equivalent to meaningful human participation in the original decision.
The question is therefore not simply whether an appeal exists. It is whether the organisation has provided a genuine opportunity for a competent and empowered human to assess the individual case and, where appropriate, change the outcome.
Key Takeaways
The Uber decision does not mean that platforms must abandon automation, but it reinforces the importance of distinguishing between automated processing that assists a decision and automated processing that effectively determines the outcome.
Where automated decision-making significantly affects individuals, it is essential to assess whether the system involves meaningful human intervention. For organisations relying on such systems, “human in the loop” should not be treated as sufficient in itself. The relevant question is whether human intervention is substantive, independent, and capable of changing the outcome.
As regulatory scrutiny of automated decision-making continues to develop, organisations will need to be able to demonstrate not simply that a human exists somewhere in the process, but what that human does and how that intervention affects the decision.
One practical approach could be to implement systems that generate automated flags for human review, rather than triggering automatic enforcement actions, particularly where the outcome can have significant consequences for an individual. The Dutch Data Protection Supervisory Authority has also developed guidelines to support meaningful human intervention in algorithmic decision-making that may help organisations to navigate these requirements.