Foodinho – €5,000,000 Fine (Italy, 2024)

In this case the controller is Foodinho a food delivery company managing the service “Glovo” in Italy. This company is owned by Glovoapp23 SA, a Spanish holding. The DPA started its investigation following the death of one of its employees while he was delivering food. The controller uses an online platform provided by Glovo ES (appointed as processor) to manage its employees and the deliveries. This platform allows to see a map of every place in the World where Glovo operates and the live location of each employee. The controller, by clicking on a “rider”, can view their location, the time slots in which they are available, the deliveries they performed and the track they followed. The investigation showed that this geolocation function was active, in some cases, even outside working hours and when the app was not active. Moreover, the controller implemented a facial recognition function for identity verification purposes, provided by a processor, Jumio Corporation. According to this procedure, the data subjects (employees) needed to upload an ID card and take a selfie of themselves. After that, the data subjects were asked to take a selfie in random occasions. If they refused to do so, their possibility of getting further delivery time slots was blocked. The controller argued that this processing was necessary to comply with Article 23 of the applicable collective agreement, stating that it’s forbidden for the employees to be replaced by a third party. Furthermore, the investigation showed that the controller’s software allowed to rate the data subjects. The controller argued that this rating function is not active for Italy. The DPA considered that the data processing is made by Foodinho, who fits the definition of controller as it decides the purposes and means of processing, as laid out in the privacy notice given to riders and in the contract with GlovoApp 23 SA. The case at hand does not concern a cross-border data processing activity as the data processing happened in the context of contracts stipulated by an Italian entity, having legal autonomous legal personality and registered in Italy. Thus the Italian DPA is competent to rule on this matter. Violation of Article 5(1)(a), (c) and (d) GDPR and of Article 25 GDPR Once notified of the death of the rider, even if the controller set the status of the rider as “disabled” with an explicit note in description, an automatic notification of dis-activating of the account was sent. The automatic notification was considered a mistake due to human error. The DPA found that the notification was not due to human error as, even if the deactivation of the account was done manually after the rider´s death, the message sent automatically is a product of the system settings of the company. Such automatic sending violates Article 5(1)(a), (c) and (d) GDPR and of Article 25 GDPR. Violation of Article 13 GDPR The DPA considered that the data processing, through the automatic and independent sending of a message without regards to the concrete circumstances of the deactivation of the account, shows that the controller did not put into respect the relevant data protection principles. Article 13 GDPR was violated as the controller failed to produce the relevant documents and, contrarily to what was claimed, did not use a “layered approach” to the provision of information. In fact, the absence of a coherent layered approach, as well as the lack of coordination between the different documents provided made it impossible to the requesting parties to have a clear overview of the types of data processing that the controller puts into place on personal data. Thus, as the controller did not provide information in a complete manner and did not provide them in a concise, transparent, intelligible and easily accessible form, the DPA found a violation of Article 13 GDPR. Violation of Article 6(1)(b) GDPR The controller put forward four versions of their data privacy notice from 13-14 December 2022 to 29 February 2024. All of these versions present the same points of concern: - The controller did not indicate specifically the categories of data that the controller processes, such as those related to handling orders chat and emails between riders and customer care. - Different legal basis are mentioned even if, at point 4, the main legal basis is “processing necessary for the performance of a contract” as per Article 6(1)(b) GDPR. - With regards to geolocation, vague legal bases like “fight against terrorism”, “money laundering” and “crimes against public health” were used, even if no reference to them is made anywhere else. In fact, the formulation of the notice does not allow to understand the scope of processing of geolocation data. While it is stated that the controller can process such data only when the rider activates the geolocation function while working, in practice the investigation found that GPS is active even when the app is in the background and, until August 2023, even when the app was closed. Violation of Article 28 GDPR A violation of Article 28 GDPR was found due to the designation of riders as “processors”. This is unlawful as in concreto, riders do not have the characteristics to fulfil that definition. Violation of Article 5, 22(3) and 25 GDPR The presence of automated decision making processes, such as the “excellence system”, the “shift assignment”, the “rating” of riders, the “deactivation and blocking of accounts” as well as absence of appropriate safeguard measures, brought forward a violation of Articles 5, 22(3) and 25 GDPR. Violation of Article 5(1)(a) and 9(2)(b) GDPR A violation of Articles 5(1)(a) and 9(2)(b) GDPR was found due to the linking of the processing of biometric data to the access to the rider´s account as well as the access to the available shifts. Violation of Article 35 GDPR Furthermore, the DPA considered that the controller failed to take into account the results of the already made DPIAs, i.e. the one dated October 2020 and the one of February 2024, as per Article 35 GDPR. The fact that the DPIA does not take into account the lawfulness requirement, especially with regards to the processing of biometric data in the context of employment relations. Violation of Article 32 GDPR Article 32 GDPR was also violated as, during investigations it emerged that operators of controllers can access to personal data of riders working for other enterprises belonging to the Glovo group and active in different countries, both in and outside the EU. Violation of Article 5(1)(e) GDPR Additionally, the DPA considered that Article 5(1)(e) GDPR was violated as the controller stores for 36 months the recordings of cellphone calls with riders. The grounds behind such processing are, according to the DPA, not aligned with such a long retention period. Violation of Article 5(1)(c), 6, 13, 14 and 25 GDPR The DPA also found that the controller shared personal data of the riders with third parties, among which Google Firebase, Braze and mParticle. This sharing violated Articles 5(1)(c), 6, 13, 14 and 25 GDPR. Violation of Article 5(1)(a) and 88 GDPR Finally, the DPA found a violation of Articles 5(1)(a) and 88 GDPR as the modalities through which the controller organizes and handles its delivery service, i.e. the geolocation policy and assignment of shifts based on the “excellence” ranking are not “inextricably linked” to the activity but instead simply part of the organizational model chosen by the controller. To further confirm this, the DPA explicated that no element proves that the tasks of riders cannot be fulfilled without the technological instruments and modalities used by the controller. Imposition of a fine Given the continuous duration of the violations, the extent of data subjects involved, the malicious character of the breach, the aggravating factor of having had a former decision and the level of gravity of the damage to data subjects in question, the DPA deemed it appropriate to impose a fine of €5,000,000.