Key Points
- Deliveroo said it would not be able to remain competitive without significant investment in the local market.
- It's unknown how many local customers Deliveroo had.
- The terms and conditions of service state that they reserve the right to sell data to third parties.
It's now just over a week since Deliveroo's shock announcement that it would exit the Australian market, and questions remain over what will happen to the data of its former customers and riders.
The United Kingdom-based food delivery company announced last week that its Australian operations would due to tough market conditions.
It said it would not be able to remain competitive without significant investment in the local market.
The decision affected more than 15,000 delivery partners, 120 Australia-based staff members, and more than 12,000 restaurants that offered meals through the service.
It's unknown how many local customers Deliveroo had, but its most recent annual report notes an average of eight million monthly active users, most of whom are based in the UK.
Its departure drew the ire of the Transport Workers' Union (TWU), which said it would seek an urgent meeting with the company's administrators to broach data protection and compensation for workers.
But what data does Deliveroo hold, and what might become of it?
Deliveroo data: What did the company collect?
The company's state that it collects personal information, such as your name, addresses (including emails), and payment information. It also notes it may collect order and geolocation data.
"They'll have records on how frequently you order ... for riders they'll have a sense of how often those riders are working, as well as other personal identifying information, including for restaurants," said James Clarke, the executive director of Digital Rights Watch.
"They'll have data on individuals, but they also have it at an aggregate level. So they'll have a sense of what foods are popular in particular areas and what restaurants are doing well."
Deliveroo announced last week that it's Australian operations would enter voluntary administration due to tough market conditions. Source: AAP / Niall Carson/PA/Alamy
"Deliveroo does say [in ] that it may share this information with marketing partners or organisations affiliated with them, and these can be outside Australia. And they can use this information to gather user behaviour patterns," Mr Nanda said.
What will become of the data now the company has collapsed?
Deliveroo's state that they reserve the right to, among other things, sell data to third parties "for any purpose related to our business".
Because of this, it's possible that data could be sold in the winding up of its Australian operations, according to Orla McCoy, a restructuring and insolvency partner at law firm ClaytonUtz.
"I wouldn't think Deliveroo had many assets in Australia ... and so if the administrators are looking to recover money for creditors, they'll be looking at all avenues, including selling the data if they're permitted to do so," Ms McCoy said.
However, it could be tricky for Deliveroo's administrators, KordaMentha, to obtain the data. It is , and therefore may not be considered an asset of its Australian operations.
Ms McCoy was involved in the administration of rival food delivery company, . Australian data was held by its parent company in Germany.
"In the case of Foodora, the Australian administrators had to get the consent of the German parent company to access the data so that they could communicate with the riders who became the creditors of the company."
Deliveroo says it takes "reasonable steps to destroy or permanently de-identify personal information" when the company no longer requires it. This is in line with what is required under one of Australia's Privacy Principles (APPs).
SBS News asked the Office of the Information Commissioner whether the Privacy Act applied to Australian data stored overseas. The agency pointed to , which states an entity "must take reasonable steps reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information" that is being disclosed.
The TWU is set to meet Deliveroo's administrators next week.
National secretary Michael Kaine said the union would be "pushing for workers' data to be protected", and for compensation.
Does Australia need tougher data privacy laws?
In short, yes, according to experts.
Mr Nanda described Australia's approach as "a mess". He said Australia should look to , which gives individuals more control over how their data is used and stored, for inspiration.
Digital Rights Watch wants a "fair and reasonable" requirement to be legislated.
"This is so companies can't manipulate or trick people into giving consent for their data to be unreasonably used beyond that data was being handed over," Mr Clarke said.
Can I ask Deliveroo to delete my data?
Users can navigate to "account details" on the Deliveroo app. There is an option to delete your account at the bottom of the page.
"We'll delete your account and associated personal data within one month, and in line with our privacy policy. Deleting your account is permanent," a message in this section reads.
KordaMentha says users can also contact support@deliveroo.com.au for .
SBS News contacted Civic Partners, who are handling media enquiries relating to Deliveroo's administration, for comment.
