Garante per la protezione dei dati personali — Deliveroo Italy S.r.l.
The Garante fined Deliveroo Italy EUR 2.5 million for unlawfully processing data of about 8,000 riders, citing lack of transparency in the order-assignment and shift-booking algorithms and excessive geolocation monitoring.
Key takeaway — how to prevent this
Automated decision-making and risk-scoring must be tested for discrimination and be explainable to those affected; opaque algorithms applied to people draw regulatory action.
Case brief
Read from the authority's press release on 2026-09-19. Every holding carries a short verbatim quote from that text (in IT, the document's language).
- Decided by
- Garante per la protezione dei dati personali
- Parties
- Garante per la protezione dei dati personali v. Deliveroo Italy S.r.l.
- Decision date
- July 22, 2021
- Remedy
- Deliveroo Italy was ordered to pay a fine of 2.5 million euros and correct privacy violations within 60 days, with 90 days granted to modify its algorithms to ensure transparency, human intervention, and periodic accuracy checks.
- Amount
- €2,500,000
- Appeal
- Appeal status not stated
Key holdings
Deliveroo failed to maintain transparency regarding the algorithms used for assigning orders and booking work shifts.
“Gli illeciti riguardavano tra l’altro la mancata trasparenza degli algoritmi utilizzati per la gestione dei rider, sia per l’assegnazione degli ordini sia per la prenotazione dei turni di lavoro.” — Rider: il Garante privacy sanziona Deliveroo Italy per 2,5 milioni di euro
Deliveroo conducted minute surveillance of riders through continuous device geolocation and excessive data retention.
“Dalle verifiche è inoltre emerso che Deliveroo effettua anche un minuzioso controllo sulla prestazione lavorativa dei rider - attraverso la continua geolocalizzazione del loro dispositivo” — Rider: il Garante privacy sanziona Deliveroo Italy per 2,5 milioni di euro
In plain English
The Italian Data Protection Authority, Garante per la protezione dei dati personali, fined Deliveroo Italy 2.5 million euros for unlawfully processing the personal data of approximately 8000 riders. Investigations revealed serious violations of European and national privacy laws, worker protections, and platform labor rules. Key infractions involved opaque algorithms used to manage riders, including order assignments and shift bookings. Deliveroo stated that by late 2020 it had ceased using the shift booking system. Nevertheless, the authority instructed Deliveroo to provide workers clear details on the order assignment algorithm and establish mechanisms guaranteeing human intervention to evaluate and correct automated decisions. Deliveroo must also regularly audit algorithm outputs to prevent discriminatory or distorted outcomes. In addition, the authority found that Deliveroo engaged in continuous employee monitoring by collecting location data every 12 seconds and retaining route history for 6 months. Deliveroo also stored vast amounts of personal data, including customer service chats and minute schedule deviations. Deliveroo was given 60 days to fix privacy infractions and 90 days to adjust its algorithms.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.