Glovo (Spain): Can a Data Protection Committee Replace a DPO?
No. Spain’s data protection authority found Glovo’s core activity involved large-scale processing, so a DPO was mandatory. An internal Data Protection Committee did not satisfy Article 37, and Glovo was fined €25.000.
Case Summary
| Authority | Agencia Española de Protección de Datos (AEPD) |
|---|---|
| Procedure | PS/00417/2019 |
| Decision | 1 April 2020 |
| Fine | €25.000 |
| Provision | Art. 37(1)(b) |
| How it was found | Two individual complaints, both stating that no DPO had been appointed to handle their claims |
Background
The Spanish authority fined Glovoapp23, an on-demand courier platform, for failing to designate a DPO under Art. 37(1)(b). Proceedings began after two separate complaints, filed on 21 May and 4 November 2019 (Bird & Bird).
Why It Breached GDPR
The AEPD found Glovo’s core activity involved large-scale processing of customer data. Glovo argued it was exempt and that an internal Data Protection Committee already carried out the Art. 39 tasks. The AEPD did not accept either argument (EDPO translation of the decision).
Timeline
Amber marks the decisive decision or ruling.
| Date | Event |
|---|---|
| First complaint filed with the AEPD | |
| Second complaint filed | |
| The AEPD fines Glovo for breaching Art. 37 GDPR | |
| Glovo files a request for reconsideration, which the AEPD later dismisses |
What Happened Next
Glovo notified the AEPD of a DPO appointment during the proceedings. It filed a request for reconsideration in July 2020, which was dismissed, and the fine stood (Economist & Jurist, Spanish).
Run and document the Art. 37 assessment against the WP29 large-scale factors before a complaint arrives. A committee can support a DPO, but it can’t replace the designated, published contact point that Art. 37(7) requires.
Frequently Asked Questions
Why did Glovo need a DPO?
The AEPD found that Glovo’s core activity involved large-scale processing of customer data, which triggers the designation duty in Article 37(1)(b).
Could Glovo’s Data Protection Committee count as its DPO?
No. Glovo argued its internal committee carried out the Article 39 tasks, but the AEPD did not accept that as a substitute for a designated DPO.
Did appointing a DPO during the proceedings cancel the fine?
No. Glovo notified the AEPD of a DPO appointment during the proceedings, but the €25.000 fine stood after its request for reconsideration was dismissed.
Unsure whether your core activities trigger Art. 37? A DPO assessment answers that before a complaint does.
Sources
- Bird & Bird, Spanish Authority imposes a fine on Glovo for failing to appoint a DPO (2020)
- EDPO, translation of the AEPD decision
- Economist & Jurist, on the dismissed request for reconsideration (Spanish)