Agencia Espanola de Proteccion de Datos (AEPD) — GLOVOAPP23, S.A.

Decided by

Agencia Española de Protección de Datos

Parties

Agencia Española de Protección de Datos v. GLOVOAPP23, S.A.

Decision date

March 7, 2023

Remedy

The AEPD dismissed Glovo's appeal, confirming a warning for failing to inform couriers about automated decision-making and a €550,000 fine for access control failures.

Amount

€550,000

Appeal

Appeal status not stated

Key holdings

1. Glovo was required under Article 13 of the GDPR to inform couriers that its excellence score system carried out automated decision-making under Article 22.

   “debieron ser informados de que se tomaban decisiones automatizadas de las contempladas en el art. 22 del RGPD, en los términos recogidos en el art. 13 del RGPD.” — page 3

2. The allocation of courier priority for selecting time slots was executed automatically by the application without human intervention, except upon subsequent courier complaints.

   “La decisión sobre el orden en que se permitía acceder a los repartidores a las franjas horarias era adoptada por la aplicación, sin intervención humana de ningún tipo.” — page 4

3. Glovo's data access permissions system violated Articles 25 and 32 of the GDPR by allowing access to courier personal data beyond what was necessary for users' duties.

   “el sistema utilizado para la gestión de permisos de acceso a los datos de los repartidores permitía el acceso a datos no necesarios para el trabajo de los usuarios.” — page 1

4. The Spanish Data Protection Agency dismissed Glovo's administrative appeal against the sanctioning resolution issued on March 7, 2023.

   “DESESTIMAR el recurso de reposición interpuesto por GLOVOAPP23, S.A. contra la resolución de esta Agencia Española de Protección de Datos dictada con fecha 7 de marzo de 2023” — page 73

In plain English

In this decision, the Spanish Data Protection Agency rejected an administrative appeal filed by Glovoapp23, S.A. against a sanction originally issued on March 7, 2023. The original ruling found that Glovo breached data protection rules governing algorithmic management and data security. Specifically, Glovo used an automated excellence score system to determine the order in which delivery couriers could select preferred work time slots. Because this automated evaluation directly affected couriers' work access and earnings, Glovo was legally required under Article 13 and Article 22 of the General Data Protection Regulation to inform couriers about the automated decision-making process. The authority rejected Glovo's argument that human intervention existed, finding that human review occurred only after couriers submitted complaints. Additionally, the agency found that Glovo failed to implement adequate technical and organizational measures under Article 25 and Article 32. Glovo's access permission system granted users access to personal data belonging to couriers across Europe that was not necessary for their tasks, affecting 7,073 active couriers in Spain. The agency affirmed its decision to issue a warning for the transparency violation and a fine of 550,000 euros for the security and access control failures. This case highlights regulatory scrutiny over algorithmic management in platform work and the strict requirements for transparency and data minimization when managing gig economy workers.