News

When Glovo Fails to Meet Its Obligations 📦🇪🇸
📌 AEPD PS/00417/2019

A Spanish citizen filed a complaint against Glovo (GlovoApp23, SL), a home delivery service, for failing to appoint a Data Protection Officer (DPO) in violation of Article 37 of the GDPR.

🔍 The Facts:
❌ Glovo's website contained no information about a designated DPO.
❌ The company claimed that an internal data protection committee was sufficient, with no need for formal designation.
📅 Glovo stated it appointed a DPO on March 13, 2019, but did not make the information public until February 2020.
📭 As a result, users had no way to contact the DPO to exercise their rights (access, rectification, objection, etc.).

⚖️ Legal Reminder:
According to Article 37 of the GDPR, appointing a DPO is mandatory when data processing involves regular and systematic monitoring on a large scale of individuals. This clearly applies to services like home delivery.

💥 AEPD Sanctions:
• 💸 Fine: €25,000
• 📉 Reputational damage
• 📋 Obligation to ensure compliance
• 👁️ Ongoing monitoring by the AEPD