The exception does not break the rule: it explains it. When a selection, monitoring, or allocation system works for most people, the case left outside is not noise to be erased. It shows which assumptions the rule contains, which information it accepts as valid, and who bears the cost when reality does not fit its categories. In automated work, that difference can decide a contract, a shift, a break, an assessment, or the possibility of continuing to earn an income.
An exception is not always a software error. It may be an absence caused by illness that looks like lack of commitment, a safety break recorded as inactivity, or a career history that a filter mistakes for an inconvenient age. The system then executes an inadequate rule consistently. Technical accuracy does not cure that inadequacy: a classification can be reproduced without malfunction and remain unfair because it measures a poor proxy, omits context, or turns a correlation into an employment consequence.
This distinction changes the control question. It is not enough to know how many decisions were correct on average. It is necessary to observe which cases disagree, why they do so, which groups appear more often among the disagreements, and whether an effective route can suspend the harm. The following three cases are real and arise from institutional action. They are not presented as legal equivalents: they belong to different countries, rules, and moments. They are read together because they reveal one workplace design principle: a responsible rule must learn from what it cannot interpret.
Why the exception reveals the real design#
Every management system reduces a complex situation to variables that can be processed. A logistics tool records scans, time, and routes; a delivery platform combines availability, acceptance, and completed orders; a recruitment filter sorts application data. That reduction may help coordinate tasks, but it stops being a mere aid when its results distribute opportunities or penalties. At that point, every variable expresses a normative choice: what counts as performance, which absence is legitimate, how much time appears normal, and which difference is treated as suspicious.
Every management system reduces a complex situation to variables that can be processed.
The average conceals precisely the area where those choices become visible. If nine out of ten records fit, the tenth permits examination of the embedded mental model. A person may have worked with faulty equipment, supported a new colleague, followed a safety protocol, needed an accommodation, or experienced an interruption outside their control. If only the final number is retained, prudent conduct can look unproductive. If the explanation is included, the same data can reveal a breakdown, poor planning, or an impossible workload.
Human review is also useless when it merely confirms the screen. It needs competence, time, information, and authority to change the outcome. A reviewer needs to know the indicator’s purpose, provenance, comparison limits, and the evidence supplied by the affected person. A record of what was corrected must also remain. Without those conditions, an appeal becomes a second execution of the same rule, while the appearance of supervision conceals the absence of a genuine decision.
An organisation can test quality through an exception register. Each disagreement should describe the triggering data, proposed consequence, missing context, final decision, and preventive modification. The register should not be used to profile the individual, but to detect system patterns. If several justified breaks end up labelled as inactivity, the issue is no longer individual. If one group needs more appeals to obtain the same result, the cost of correction operates as an additional inequality.
Workplace dignity appears in this capacity not to be reduced to an indicator. It does not require the removal of all automation or the uncritical acceptance of every explanation. It requires proportionality, relevant data, an opportunity to be heard, and locatable responsibility. The exception thus becomes a stress test: if the rule can recognise it, halt the consequence, and learn from it, governance exists. If it can only penalise it faster, managerial power has been automated without a counterweight.
Case one: Amazon France and the second turned into a signal#
In December 2023, the French data protection authority fined Amazon France Logistique 32 million euros. The proceeding examined the use of scanners in large French warehouses. Each scan generated data used to calculate indicators concerning quality, productivity, and periods of inactivity. The authority considered part of the monitoring excessively intrusive and identified, among other problems, highly detailed assessment linked to every scan and the possibility that even brief interruptions might have to be justified.
The case shows how a temporal exception can explain the entire rule. An interval without a scan looks like objective data, but it does not contain its cause. It may represent movement, waiting, a necessary conversation, a device problem, task reorganisation, or a break. When the indicator automatically converts the interval into suspected poor performance, it does not discover intention; it presumes it. The real rule ceases to be “record activity” and becomes “every unrecorded fraction requires a defence.” The device turns absence of signal into a signal against the person.
The CNIL did not deny that a warehouse needed data for planning, training, or assistance. Its decision emphasised that less detailed or aggregated data could be used for particular purposes. That difference is central: a legitimate purpose does not authorise every degree of granularity. Per-second data may appear better because it is more abundant, even when it increases surveillance without improving a necessary decision. Data minimisation requires an explanation of which resolution adds value and how long it must be retained.
An exception test for a warehouse would begin by classifying interruptions before attributing them. A threshold should never produce an employment warning on its own. It should open a review that checks equipment status, local incidents, task changes, training, safety, and the person’s account. Collective patterns also matter: if many intervals arise in the same aisle or shift, the reasonable hypothesis moves from individual conduct towards work organisation.
The case further teaches that health cannot be treated as a statistical deviation. A pace constructed from the fastest records can turn the extreme into the norm and pressure everyone else to reach it. The reference should rest on safe and sustainable work, not merely the maximum observed capacity. The exception made by a person who stops to avoid a hazard does not break productivity; it reveals whether the definition of productivity includes the body performing the task.
Case two: Foodinho and allocation without context#
In June 2021, the Italian data protection authority issued an order against Foodinho, a Glovo group company, and imposed a 2.6-million-euro fine. The investigation concerned approximately 19,000 riders. The authority described extensive data processing, from geolocation and delivery times to customer-support communications, ratings, and battery level. It also examined a scoring system that could favour riders who accepted quickly and completed more deliveries, while penalising rejections or failure to connect during a booked slot.
Refusal of an order is the kind of exception that a system can count without understanding. The record confirms that acceptance did not occur, but it does not distinguish a breakdown, road hazard, incompatible assignment, emergency, contradictory instruction, or poor connection. If every refusal reduces future access to work, the platform presents a decision made under pressure as a free preference. The rule rewards immediate availability even if its formal label is only reliability.
The Garante identified inadequate information about the logic and consequences of the processing, as well as insufficient safeguards for accuracy and fairness. It also required measures allowing human intervention, expression of a point of view, and challenges to automated decisions. Those elements are not an administrative appendix. They determine whether partial data can become lost opportunity before the context that completes it has been included.
Proportionate management would separate immediate coordination from a lasting employment assessment. Knowing that an order needs another rider may be necessary within seconds; concluding that the rider who rejected it deserves fewer future slots requires a different justification. The first decision completes a delivery. The second redistributes income and requires relevant data, explanation, and appeal. Combining them allows a brief operational need to produce an invisible cumulative penalty.
The exception also reveals dependence between metrics. Geolocation, estimated time, battery, and response may look like independent signals even when they arise from one technical incident. Adding them as confirmations artificially increases certainty. An audit should trace that dependence, measure false positives, and examine who is penalised because of coverage, device, disability, caring responsibilities, or exposure to difficult areas. The purpose would not be to create special treatment, but to prevent conditions unrelated to performance from masquerading as merit.
The Foodinho case turns challenges into a quality measure. Each successful appeal provides evidence about a defective category. It should activate individual correction, restoration of lost opportunity, and model review. If the system learns only from completed orders and not from corrected decisions, institutional experience disappears. The exception returns as if it were new, and the person repeatedly pays for a defect that is already known.
Case three: iTutorGroup and the age that exposed the filter#
In September 2023, the United States Equal Employment Opportunity Commission announced a 365,000-dollar settlement with iTutorGroup. According to the EEOC lawsuit, the application software had been programmed to reject automatically women aged 55 or older and men aged 60 or older. More than 200 qualified applicants based in the United States were rejected because of age. The settlement included monetary and non-monetary relief, together with institutional monitoring.
Here, the exception was not a borderline case that the model failed to classify. It was the discriminatory rule exposed by its outcomes. An application could contain relevant experience, availability, and adequate capabilities; once an age threshold was crossed, all of that content ceased to matter. The filter’s apparent efficiency concealed a prohibited employment decision. Automation did not create distance from the criterion: it enabled the criterion to be applied uniformly, silently, and at scale.
The case demonstrates why an overall accuracy rate would be an inadequate defence. A system might process thousands of applications and often coincide with later decisions, but systematic rejection of one group would remain material. Evaluation needs breakdowns by age and sex, tests around every threshold, and equivalent applications that vary only the protected attribute. The statistical exception may be small in volume and absolute in the life of the person denied access.
Provider, tool, and employer must also be distinguished. An organisation does not transfer responsibility by purchasing software. Before deployment, it should document criteria, test outcomes, limit fields, verify changes, and retain the ability to suspend the tool. During use, it should compare who advances, who is excluded, and which appeals succeed. Once harm is detected, remedy does not end with a code adjustment: it reaches rejected people and the opportunities they were unable to contest.
Individual review needs to arrive before the vacancy closes. A channel that responds months later may recognise the error without restoring the employment option. Deadlines, suspension of the decision where feasible, and a responsible person with access to the full application are therefore needed. A rejection notice should provide enough information to identify a possible mistake without disclosing mechanisms that enable fraud or hiding the reason beneath an empty formula.
iTutorGroup leaves an especially clear lesson: consistency is not neutrality. A rule applied identically across every server can discriminate with perfect stability. The responsible question is not whether the machine deviated, but whether the criterion was legitimate, relevant, and tested. The exception—the qualified person who disappears because of data unrelated to capability—explains the filter’s real function better than any commercial description.
Four institutional sources and a test for decisions#
The four sources allow the argument to be reconstructed without confusing fact and interpretation. The CNIL on Amazon France Logistique documents scanner monitoring, the fine, and the proportionality analysis. The Italian Garante on Foodinho describes scoring, risks of error or discrimination, and required safeguards. The EEOC on iTutorGroup records the lawsuit, settlement, and relief. The ILO on algorithmic management supplies the framework: programmed procedures coordinate labour on platforms and in conventional workplaces, with implications for work organisation and job quality.
A seven-question test can be derived from those sources. First, the decision receiving automated support and its possible consequence must be declared. Second, the proxy data must be identified: scan, rejection, score, age, or another signal. Third, the different causes capable of producing the same data must be recorded. Fourth, boundary cases and potentially affected groups must be tested. Fifth, competent human review must exist before harm becomes difficult to reverse. Sixth, individual correction must restore income, shift, or opportunity where possible. Seventh, every confirmed exception must change the rule, interface, training, or threshold.
The test must take place before deployment, recur after changes, and continue throughout use. A sample of normal cases is insufficient. Adverse scenarios are needed: faulty equipment, network outage, safe break, illness, disability, caring responsibility, unconventional application, and combinations of protected attributes. The burden of appeal must also be observed. A procedure demanding time, technical language, or inaccessible documentation shifts the cost of the defect towards the person who has already suffered the decision.
Governance indicators should include more than accuracy. It is useful to measure challenge rates, proportion of corrected decisions, time to remedy, restored opportunities, differences between groups, recurrence of the same error, and modifications introduced. A high correction rate may reveal a poor rule; a low rate does not prove quality if nobody knows the channel or if retaliation is feared. Data needs to be accompanied by interviews, worker representation, and review of cases closed without an answer.
Participation by the people performing the work provides knowledge that does not exist in the dataset. A person knows why a route is delayed, when a break prevents injury, or which experience does not fit a form. That voice does not replace evidence; it completes the problem definition. Collective representation also helps identify patterns that each individual may perceive as a private accident. What recurs ceases to be a personal exception and becomes an organisational signal.
A dignified rule retains three capacities. It can explain in understandable language which data influenced the result. It can halt a consequence while a serious disagreement is reviewed. It can remedy and learn without requiring every affected person to prove a known defect from the beginning. These capacities require time and resources, but that cost belongs to the system choosing to automate, not to the person being classified.
The exception, therefore, is not the residue left after optimising the average. It is the test that reveals what is being optimised. Amazon France Logistique showed the risk of converting intervals without scans into detailed surveillance; Foodinho, the risk of turning a response without context into unequal access to assignments; iTutorGroup, the risk of applying a discriminatory threshold at scale. In all three cases, examining the discrepant outcome revealed a rule that an aggregate indicator could conceal.
Work that does not surrender dignity does not promise systems incapable of error. It requires systems capable of recognising a limit, hearing an explanation, correcting the consequence, and changing the rule. When that chain exists, automation remains subordinate to the purpose of work. When it is absent, the exception still explains the rule, but it does so at the expense of the person left outside.
