"Deliveroo’s substitute courier policy called into question", 6 August 2018

Deliveroo narrowly avoided demands for union recognition and workers’ rights last year, after giving couriers the option of substituting people to deliver food on their behalf. The Central Arbitration Committee, a government body that oversees the regulation of UK labour laws, ruled that the contractual promise meant riders were self-employed, not workers entitled to collective bargaining powers and other rights...

[T]he Independent Workers Union of Great Britain [...] said Deliveroo’s data protection obligations under the EU’s General Data Protection Regulation contradicted the substitute policy...

Deliveroo’s data terms say couriers must keep customer information safe.

“You have the right, without the need to obtain Deliveroo’s separate prior approval, to arrange for a substitute to process the customer data on your behalf...” the policy says...

But under the UK’s Data Protection Act, which translates GDPR into UK law, Deliveroo is ultimately responsible for keeping data safe and would need to be informed when a courier appointed a substitute.

“This sounds awfully like Deliveroo has an absolute right to refuse consent to the use of a substitute by a Deliveroo rider,” said Mr Moyers-Lee, [general secretary for the IWGB]...

Deliveroo said: “The courts have made clear that Deliveroo riders are self-employed and we are confident that Deliveroo’s data policy is consistent with the right to substitute.

“We continue to make the case that the government should end the trade-off between flexibility and security by allowing companies like Deliveroo to offer further benefits without the risk of reclassification.” [also refers to Uber and Airbnb]