Italian DPA fines local food delivery service company for tracking drivers’ location

The Garante per la Protezione dei Dati Personali (GPDP) has imposed a sanction of € 5 million to Foodinho, a local food delivery service company that’s owned by DeliveryHero, for unlawfully processing personal data of more than 35,000 drivers.

The Italian data protection authority (DPA) found out that the food delivery service violated the General Data Protection Regulation (GDPR) in numerous ways.

It discovered that when an account is deactivated or blocked by the platform the company uses, it sends a single standard message, but doesn’t inform of the possibility of contesting the decision and request the recovery of the account.

Furthermore, the GDPD learned that Foodinho processed drivers’ personal data. For example, there's an excellence system in place, which allows employees to book their work shift with priority. In addition, there’s a system for assigning orders within the shift. The company uses these automated systems without informing employees they can object to the challenges that are made by the systems, which is a violation of the GDPR.

In addition, the investigation revealed that Foodinho sends drivers’ personal information, like location data, to third party companies without their knowledge. Even when an employee wasn’t working, his location was being sent to the food delivery service company and third parties. Until August 2023, this also happened when the app wasn’t active in the background.

The Italian DPA orders Foodinho to reformulate the messages sent to drivers in case of account deactivation or blocking, and ensure that the decisions made by the algorithm are verified by properly trained operators. Also, the company will have to activate an icon on drivers’ devices indicating that the GPS is active and disable it when the app is in the background.

Lastly, Foodinho will have to take appropriate measures to avoid improper and discriminatory use of reputational mechanisms based on customer feedback.