---
title: "Foodinho s.r.l. fined EUR 5,000,000 (Italy, 2024)"
canonical: "https://dposchool.com/gdpr/fine/garante-foodinho-2024-11"
source: "https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601"
source_note: "Only the authority's decision is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Fine · Italy

# Foodinho s.r.l.: EUR 5,000,000

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Authority:** Garante per la protezione dei dati personali
- **Country:** Italy
- **Date:** Decision of 13 November 2024
- **Amount:** EUR 5,000,000, as imposed (not converted)
- **Appeal status:** Unknown
- **Provisions cited:** [Article 5(1)(a)](https://dposchool.com/gdpr/article/5#1-a), [Article 5(1)(c)](https://dposchool.com/gdpr/article/5#1-c), [Article 5(1)(d)](https://dposchool.com/gdpr/article/5#1-d), [Article 5(1)(e)](https://dposchool.com/gdpr/article/5#1-e), [Article 6](https://dposchool.com/gdpr/article/6), [Article 9(2)(b)](https://dposchool.com/gdpr/article/9#2-b), [Article 12](https://dposchool.com/gdpr/article/12), [Article 13](https://dposchool.com/gdpr/article/13), [Article 22(3)](https://dposchool.com/gdpr/article/22#3), [Article 25](https://dposchool.com/gdpr/article/25), [Article 28](https://dposchool.com/gdpr/article/28), [Article 32](https://dposchool.com/gdpr/article/32), [Article 35](https://dposchool.com/gdpr/article/35), [Article 88](https://dposchool.com/gdpr/article/88)

## What the fine was for (summary, not the official text)

Glovo-group delivery platform geolocated over 35,000 riders even off shift, used facial recognition for identity checks, made automated decisions (including deactivations) without safeguards, and let other group companies see rider data.

## Official source

- [Decision or announcement of the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074601)

Checked against the official source on 28 October 2026.

Only the authority's decision is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Fines](https://dposchool.com/gdpr/fines) / Foodinho s.r.l.

[All fines](https://dposchool.com/gdpr/fines)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents