Toto-Rex's story
Toto-Rex now drives for a ride app to pay the bills.
One night, a message pops up: 'Your account has been deactivated due to suspected fraud.'
Toto-Rex taps 'Appeal'. An automatic reply arrives within seconds.
Toto-Rex wonders: did a human ever look at this?
Toto-Rex's story is made up. The rules and cases in this video are real.
The short answer
In the EU, yes, unless a valid exception applies.
The details
The GDPR generally bans decisions based solely on automated processing of personal data if they have a legal or similarly significant effect on you.
A dismissal is one example. Three exceptions exist.
One: the decision is necessary to enter into or perform a contract with you.
Two: EU or national law authorises it and sets safeguards. Three: you give valid explicit consent.
At work, consent is hard to rely on. Employees can give free consent only in exceptional cases.
An exception does not switch off the GDPR's other rules.
Under the contract and consent routes, you keep minimum rights. You can ask a human to step in.
You can give your view. You can contest the decision.
For the law route, the EU Court of Justice says the authorising law itself must provide the same minimum safeguards.
A human who merely rubber-stamps the decision does not count.
In 2023, the Amsterdam Court of Appeal examined Uber's deactivation of four drivers' accounts.
For three of them, Uber could not show meaningful human involvement.
So the court treated those three decisions as solely automated.
For the remaining driver, Uber said it had a personal conversation with him before the deactivation. He did not dispute this.
The court accepted this as evidence of meaningful human involvement in his case.
Useful to know: if an organisation says an exception applies, ask which one. Then ask how to get human review.
UK note: since 5 February 2026, UK law allows more solely automated decisions than EU law, with safeguards. Decisions based on special category data, such as health data, face stricter limits.
Real-life examples
Real life: the Amsterdam Court of Appeal, 4 April 2023.
In the Uber case, the court said the deactivations affected the drivers at least to a considerable extent, because they could no longer earn an income through the app.
Uber said the decisions were based on human review.
On the same day, in a separate case, the court ordered Ola, another ride-hailing company, to give drivers information about its automated decision-making.
That included a 'fraud probability score' and an 'earnings profile' used in allocating work and fares.
Real life: new EU rules for platform work.
EU countries must bring the Platform Work Directive's rules into force by 2 December 2026.
Under those rules, a decision to restrict, suspend, or end a platform worker's contract or account must be taken by a human being.
Platforms must also regularly evaluate the impact of decisions taken or supported by automated systems, with workers' representatives involved.
Where human oversight finds a high risk of discrimination, the platform must take appropriate action.
Real life: the UK, as reported in March 2022.
During redundancies at MAC, an Estée Lauder company, three make- up artists had to reapply for their jobs through a video interview run by HireVue.
They were told they were being made redundant, partly on the basis of the software's automated judgement.
They said no one could explain how they had been scored.
Estée Lauder said interviewees were fully briefed, and that using the process alongside human decision-making produces fairer outcomes.
HireVue said it removed visual analysis from all new assessments in early 2020. Its published audit described a gradual phase-out from existing models, and the auditors said they had not independently checked the fixes.
The women told their story in a BBC Three documentary, Computer Says No. The case was settled out of court.
A settlement is not a court finding that the company acted unlawfully.
Back to Toto-Rex
An automatic reply to an appeal is not, by itself, human review.
In the EU, if the deactivation was a solely automated decision with a serious effect, it is generally banned unless an exception applies.
Even where an exception applies, Toto-Rex can ask a human to step in, give a view, and contest the decision.
Toto-Rex can also ask for information about automated decision- making, as the Ola drivers did.
Once the national rules implementing the EU Platform Work Directive apply to Toto-Rex, a human must take any decision to suspend or end Toto-Rex's account.
Summary
In short: in the EU, a machine alone cannot decide a dismissal, unless one of three exceptions applies.
Safeguards still apply, including the right to ask a real human to review it.
UK law allows more, with safeguards.
Three key terms
Solely automated decision
A machine makes the decision. No human plays a meaningful part.
A human who merely rubber-stamps the output does not count.
Legal or similarly significant effect
The decision changes your legal rights or status. Or it affects your circumstances in a comparably serious way.
For example: losing your job.
Human intervention
A real person genuinely reviews the decision. That person has the power and the know-how to change it.
Further reading
Start with GDPR Article 22: the rule and its three exceptions.
The Amsterdam Court of Appeal judgment on the Uber drivers is in Dutch.
The Article 29 Working Party guidelines, endorsed by the EDPB, explain automated decisions in more detail.
For the UK, see Articles 22A to 22D of the UK GDPR, inserted by section 80 of the Data (Use and Access) Act 2025.
For platform workers, see Directive (EU) 2024/2831 on EUR-Lex.
Sources
GDPR (Regulation (EU) 2016/679), Article 22. CJEU, Case C-634/21, SCHUFA Holding (Scoring), 7 December 2023, paragraph 66. EDPB, Guidelines 05/2020 on consent.
Amsterdam Court of Appeal, 4 April 2023, ECLI:NL:GHAMS:2023:793. Article 29 Working Party, Guidelines on Automated Individual Decision-Making and Profiling (WP251 rev.01, 2018), endorsed by the EDPB. Data (Use and Access) Act 2025, section 80 (UK GDPR, Articles 22A to 22D).
Amsterdam Court of Appeal, 4 April 2023, ECLI:NL:GHAMS:2023:804 (Ola). Directive (EU) 2024/2831 on improving working conditions in platform work.
Personnel Today, 'Estée Lauder staff win payout after being sacked by algorithm', 17 March 2022.
HireVue, announcement of 12 January 2021. ORCAA, 'Description of Algorithmic Audit: Pre-built Assessments', 15 December 2020, published January 2021.