Ride-hailing, car sharing and mobility apps

• Regulation (EU) 2016/679 — GDPR, Articles 22 and 27
• Regulation (EU) 2022/2065 — DSA
• Directive (EU) 2019/1152 and the platform work Directive
• Regulation (EU) 2024/1689 — AI Act for worker management

Who has to appoint one

Mobility platforms established outside the Union operating in the EU. Three fronts open at once: passenger and driver data, algorithmic management of workers, and the local licensing rules for the transport activity itself, which vary by city.

Thresholds and exemptions

No data protection threshold. The platform work rules apply where workers are engaged through the platform, with presumption of employment mechanics differing by member state.

What must appear on the label

Not physical. The representative in the privacy notice, transparency to drivers about the algorithms allocating work and assessing performance, and price transparency to passengers.

Marketplace fields

Cities and national regulators license the transport activity separately, and platforms have been suspended in several member states over licensing rather than data issues. Driver deactivation practices have generated litigation across the Union.

Documentation you must hold

Article 30 records covering location, ratings, deactivation and payment data, the Article 27 designation, a data protection impact assessment covering algorithmic management, documentation of any automated decision affecting drivers, and the AI Act documentation where systems allocate tasks or monitor performance.

Standards and testing

Not applicable, though automated decision systems must be explainable to affected workers and, under the AI Act, tested for accuracy and bias.

Language requirements

Driver and passenger information in the language of the market.

When it applies

The representative before processing begins. AI Act high-risk obligations for worker management from 2 August 2026.

How long records are kept

Location histories only as long as necessary; retaining full trip histories indefinitely has been challenged successfully by driver groups.

What happens if you do not comply

Up to €20 million or 4% of turnover, and courts across the Union have ordered platforms to disclose the logic of deactivation decisions and to reinstate drivers. DSA penalties apply separately where the platform intermediates.

Who enforces it

Data protection authorities, labour authorities and courts, transport licensing bodies, and Digital Services Coordinators.

Where the boundary lies

Algorithmic deactivation of a driver is an automated decision with significant effects under Article 22, and platforms have lost cases for failing to provide human review and an explanation. Worker management systems are high-risk AI from August 2026.

Questions we are asked

Can we deactivate drivers automatically?

Not without meeting Article 22: a legal basis permitting it, human intervention on request, and a meaningful explanation of the logic.

Is a mobility app a DSA platform?

Where it intermediates between drivers and passengers as an online platform, the DSA duties including the legal representative apply.