Short answer
EU law does not generally ban algorithms from allocating platform work, rating performance or helping set pay. Their use must have a lawful basis, respect data-protection and discrimination rules, and be transparent. Under the General Data Protection Regulation (GDPR), a person generally has the right not to be subject to a solely automated decision producing legal or similarly significant effects, unless an exception and safeguards apply.
Directive (EU) 2024/2831 adds platform-specific rules. Once transposed, it will require disclosure of monitored data, decision categories, main parameters and their relative importance. It prohibits particular data uses, requires competent human oversight, and says that account suspension, termination and equivalent serious decisions must be taken by a human. A person performing platform work can demand an explanation, discuss it with a qualified human contact and request review; specified serious decisions need written reasons.
Member States must transpose the Directive by 2 December 2026. As at 31 July 2026, its safeguards cannot be assumed to operate identically everywhere. The GDPR already applies. Employment and worker-management AI may also be high-risk under the AI Act, but Regulation (EU) 2026/1744 postponed the relevant Annex III high-risk requirements to 2 December 2027.
Three legal layers must be separated
The GDPR is directly applicable whenever an employer or platform processes personal data. Its general principles and rights of access, correction, objection and complaint may matter even where a decision is not wholly automated.
The Platform Work Directive is narrower by sector. It applies to a “digital labour platform” that organises paid work by individuals using automated monitoring or decision systems. Its algorithmic-management protections cover employees and many self-employed platform workers, but not an ordinary employer merely because it uses scheduling software.
The AI Act is a third layer where the tool is an “AI system” under that Regulation. Systems used for recruitment, termination, task allocation based on individual behaviour, or monitoring and evaluation in work relationships are listed as high-risk. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the applicable Annex III high-risk requirements from 2 August 2026 to 2 December 2027. That postponement does not suspend the GDPR or Platform Work Directive timetable.
Because the platform act is a directive, its obligations depend on national implementation. A platform should map all three EU layers and applicable employment and equality law.
When does the GDPR restrict the decision itself?
Article 22 GDPR addresses a specific category of decision:
“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.” —
All three elements matter. There must be a decision, it must be based solely on automated processing, and its effect must be legal or similarly significant. Automatic rejection of an applicant, effective deactivation, loss of a main income stream or a decisive pay determination may qualify. Routine route suggestions or low-impact task ordering may not, although the rest of the GDPR still applies.
Article 22 permits such a decision where it is necessary to enter into or perform a contract, authorised by EU or Member State law with suitable safeguards, or based on explicit consent. “Necessary” is stricter than convenient or cheaper. In an employment relationship, relying on consent is often difficult because the power imbalance may prevent it from being freely given.
For contractual necessity or explicit consent, safeguards must include the right to obtain human intervention, express a point of view and contest the decision. Special-category data face additional restrictions.
A score can be the real decision
A platform cannot avoid Article 22 by inserting a nominal human or second company into the chain. In Case C-634/21, SCHUFA Holding (Scoring), the Court held that an automatically generated score can itself be a decision where its recipient relies strongly on it.
Record who can depart from a recommendation, what they receive, whether overrides occur and whether review precedes the result. A human who merely clicks “approve” without authority, time or information may not provide genuine involvement.
What platform data uses will be prohibited?
Article 7 of Directive 2024/2831 requires Member States to prohibit platforms from using automated systems to process certain data. The list includes emotional or psychological state, private conversations, data collected while the person is not offering or performing platform work, and data used to predict the exercise of fundamental rights such as collective action. It also covers specified inferences about sensitive characteristics and biometric comparison against a database to establish identity.
These limits apply from recruitment and reach systems that take or support decisions. Other processing still needs a GDPR basis, defined purpose, proportionate data and security. Algorithmic monitoring is treated as likely high-risk processing, requiring a data-protection impact assessment and the views of affected people and representatives.
What must the platform explain about the system?
Article 9 requires notice that monitoring or decision systems are used or being introduced. For monitoring, the platform must describe the data and actions monitored, the purpose and method, and recipients or transfers. For decision systems, it must disclose:
- the categories of decisions taken or supported;
- the data categories and main parameters used;
- the relative importance of the main parameters;
- how personal data or behaviour influence decisions; and
- the grounds for account restriction, suspension, termination, refusal of payment, contractual-status decisions and equivalent detrimental effects.
The affected person receives concise, clear information by the first working day, before a relevant change and on request. A comprehensive and detailed version must be available on request. Recruitment-system information is due before the procedure begins. Ratings and reviews generated through performance are also covered by a portability right.
This is system-level transparency. It lets a worker understand what is being measured and how it can affect work, without requiring publication of source code.
Individual decisions need explanation and review
The Directive adds a decision-level right. A person performing platform work must be able to obtain an oral or written explanation, without undue delay, for any decision taken or supported by an automated decision system. A designated human contact must have the competence, training and authority to discuss the facts, circumstances and reasons.
Written reasons are due when serious decisions take effect, including account restriction or termination, refusal to pay completed work, contractual-status decisions and other essential changes.
The person or representative may request review and must receive a substantiated written reply within two weeks. An unlawful decision must be corrected within two weeks; if correction is impossible, adequate compensation is required and recurrence must be prevented.
One boundary matters: Article 11's review mechanism does not apply to a person who is also a “business user” under the Platform-to-Business Regulation; that Regulation's specific review protections prevail. The exact contractual and platform role therefore matters.
Deactivation must be a human decision
The Directive goes further than a right to appeal an automated deactivation:
“Any decision to restrict, suspend or terminate the contractual relationship or the account of a person performing platform work or any other decision of equivalent detriment shall be taken by a human being.” —
Under the transposed rule, an algorithm may flag conduct or assemble evidence, but an authorised human must take the serious decision. Platforms must also maintain enough trained human resources to oversee systems and override automated decisions. At least every two years, they must evaluate the effects of individual automated or algorithm-supported decisions, involving workers' representatives. Identified discrimination risks or rights violations require corrective action.
How meaningful must a GDPR explanation be?
Article 15(1)(h) GDPR gives access to meaningful information about the logic, significance and envisaged consequences of relevant automated decisions. In C-203/22, Dun & Bradstreet Austria, the Court required an intelligible explanation of the procedure and principles actually applied.
The explanation must enable the person to understand “which of his or her personal data have been used in the automated decision-making at issue”. —
A formula or technical dump is insufficient. The explanation should describe the rationale and criteria and may show how changed inputs affect the result. Trade secrecy does not justify outright refusal: protected information goes to the supervisory authority or court for rights balancing.
A compliance checklist
- Does the tool merely support a person, or does its output determine the result in practice?
- What legal basis supports every personal-data use, and is each category necessary?
- Could the decision legally or similarly significantly affect the person?
- Is genuine human involvement documented before any serious adverse result?
- Are prohibited data, off-duty collection and sensitive inferences technically blocked?
- Do notices explain monitored data, decision categories, parameters, relative importance and consequences?
- Can the person reach an authorised human and obtain individual reasons promptly?
- Can review, correction and compensation deadlines be met?
- Are discrimination, health, safety and collective-consultation duties assessed separately?
- Which Member State implementation applies on the relevant date?
Conclusion
An algorithm may support work allocation, ratings and pay only within the GDPR's general rules and any applicable employment and equality law. Solely automated decisions with legal or similarly significant effects face Article 22's prohibition, exceptions and safeguards.
For digital labour platforms, Directive 2024/2831 adds concrete transparency and review rights after national transposition and reserves deactivation and equivalent serious decisions to a human. Qualifying AI systems also face the AI Act on its amended timetable. The answer depends on the system's real influence, its effect, platform status and applicable law and date.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.