GDPR OBLIGATIONS BY UBER
Uber has failed to fulfill its obligations in several respects in its response to the GDPR Requests. This is explained in more detail below.
Incomplete information about automated decision-making and profiling
Uber performs various data processing operations that must be classified as automated decision-making and / or profiling within the meaning of the GDPR. This is evident from Uber's Privacy Statement, which lists several examples (Exhibit 7, Section 'Automated Decision Making'). However, the information in the Uber Privacy Statement is particularly brief and general, partly in view of the fact that this document relates not only to drivers, but to all users of Uber, including passengers, 'Deliverers' and 'Uber partners'.
The fact that the information provided by Uber is not complete is demonstrated by various functionalities in the Driver App that provide information about driving behavior, the use of the phone while driving and the percentage of accepted trips (Exhibit 10). The information provided here is the result of an analysis of 'professional performance', 'reliability', 'behaviour', 'location' and 'movements', as referred to in Art. 4 section 4 GDPR and should therefore be regarded as a form of 'profiling'.
The Applicants have not received any further information regarding the existence of automated decision-making and / or profiling in response to their request for inspection. They therefore request an order addressed to Uber to provide this information in accordance with Art. 15 (1) GDPR, first paragraph and under h). In particular, the Applicants wish to receive further information about automated decision-making and / or profiling in which (co-) use is made of the data categories mentioned in Guidance Notes (Exhibit 7), the Driver's Profile and / or Tags and Reports.