Italy’s data privacy regulator on Friday announced that it has levied a €5 million ($5.2 million) fine against an Italian GPS-based food delivery service for tracking the geolocation of its drivers, including outside of working hours.

The Milan-based firm, Foodinho S.r.l., is owned by the global food service company DeliveryHero. It is accused of illegally processing the personal data of more than 35,000 drivers through its digital platform, according to a press release from the regulator, Garante per la Protezione Dei Dati Personali (GPDP).

The watchdog said it also has prohibited the company from using its drivers’ biometric information to verify their identities.

An investigation found that the company’s workers’ geolocation data was shared with third-party companies without their knowledge, the press release said.

GDPD has ordered Foodinho to add an icon to its platform alerting drivers when the GPS is active and ensure that the “decisions taken by the algorithm are verified by adequately trained operators,” according to the press release. 

The regulator fined Foodinho €2.6 ($2.7 million) in 2021 for allegedly using performance algorithms to measure employees’ work outputs without transparency.