2.6 million Euro fine against Foodinho s.r.l.
Various data protection violations in the context of using automated systems to administer drivers.

Foodinho is an Italian food delivery service based in Milan, which is a subsidiary of the Spanish company GlovoApp23. The fine notice is related to a series of inspections on the handling of employee data carried out by the Italian data protection authority at some of the largest food delivery companies operating in Italy. The round of inspections, of which the present notice is a part, focused specifically on drivers as data subjects. The data protection authority found some serious violations of applicable data protection regulations on the part of Foodinho. A total of 19,000 drivers are affected.

Some grievances concerned the algorithms that the delivery service had used to manage its employees. For example, the company had not sufficiently informed workers about how the system worked and had not ensured the accuracy and correctness of the results of the algorithmic systems used to evaluate drivers. Nor were procedures established to protect the right to human intervention, expression of opinion and challenge of decisions made on the basis of the algorithms used by Foodinho. In this context, the authority instructed the company to identify measures that ensure the protection of data subjects' rights when using automated decisions.

With regard to the data processing carried out by the systems, the data protection authority also found violations of the principles of data minimisation and storage limitation. On the one hand, the systems processed driver data in a way that was more extensive than necessary for the purpose of the processing. On the other, the storage period of the different types of data had not been specifically defined.

Furthermore, the recipient of the fine had not implemented adequate technical and organisational measures to ensure a level of protection appropriate to the risk for the data subjects. Foodinho had also not carried out a data protection impact assessment, although this would have been necessary due to the risk posed to the drivers. In this context, the data protection authority also identified a failure on the part of the delivery service to realise data protection by design and by default.

Furthermore, the company had not kept a register of its processing activities and had not informed the data protection authority of the contact details of its data protection officer.

In determining the amount of the fine, aggravating factors were the fact that a high number of drivers were affected by the incident and that Foodinho had not cooperated with the data protection authority in the course of the investigations.

A separate procedure is being conducted against GlovoApp23 by the Spanish data protection authority.