Probably GDPR if they're copying dowm addresses used in the performance of their role for purposes unconnected to delivering meals. There would be no confidentiality or accountability and they'd not be stored securely once they're written on a McDonald's napkin and stored in his glovebox.