DPA case 9685994 – Violation Found (Italy, 2021)

Deliveroo Italy is owned by the UK company Roofoods LTD, whose data center is located in Ireland. They are joint controllers of rider data. When the Garante started to investigate Deliveroo Italy, Roofoods clarified that Deliveroo Italy had 8,000 riders who use the Deliveroo rider app. Roofoods acquires personal and contract data, payment data, data relating to the vehicle used for deliveries, and determines how to process riders’ data. It claims that the rider booking system in Italy is based on availability during critical time slots and reliability of the rider (ie actual participation in the reserved shifts or cancellation prior to the start of the shift). The app also tracks the management of an order by a rider (from acceptance of the order to delivery) and tracks the location of the rider every twelve seconds. After investigation, the Garante notified Deliveroo Italy and Roofoods that it had found violations of Articles 5(1)(a)(c)(e), 13, 22(3), 25, 30(1)(c)(f)(g), 32, 35, 37(7), and 88 of the GDPR. In defensive briefs, UK Roofoods contended that it was going to review its data retention policies, that Deliveroo riders were sufficiently informed about the data processed on them, and that data collected on riders (such as geographical position) was necessary for the service. It also argued that statistics about the algorithms behind the booking system are available to riders on a dedicated page in the app, and that on Sunday each rider is informed about their access to booking times for the following week. Just one month after Foodinho was fined €2,600,000 for intransparent rider management algorithms, the Garante decided to issue a very similar fine against Deliveroo. First, the Garante held that Deliveroo had provided inadequate information amount management algorithms to interested parties (riders) and to failed to comply with the principle of transparency. The privacy policy provided to riders failed to indicate the concrete methods of processing data