Germany fines H&M 35 million euros for worker ‘surveillance’

German data protection authorities said on Wednesday, September 30, that they fined Swedish fashion chain H&M more than 35 million euros ($41 million) over illegal “surveillance” of its employees.

The amount is the highest fine for such breaches in Germany since its latest data-protection legislation came into force two years ago, a spokesman for Germany’s watchdog for the issue told Agence France-Presse, in a country known for jealously guarding the right to privacy.

Company bosses at the group’s service center in Nuremberg were found to have delved too deeply into the private lives of their employees, acquiring information “ranging from rather harmless details to family problems and religious beliefs.”

Detailed “symptoms of illness and diagnoses” were also recorded and stored digitally, the authorities said in a statement.

“The present case documents a serious disregard for employee data protection at the H&M site in Nuremberg,” said Johannes Caspar, the commissioner for data protection in Hamburg, where H&M’s German arm is based.

“The level of the fine imposed is therefore appropriate and suitable to deter companies from violating the privacy of their employees.”

‘Incompatible’ with policies

The watchdog said managers at the service center conducted “welcome back” talks with employees after their return from illnesses or holidays. 

The symptoms and diagnoses of illnesses as well as holiday experiences were documented, and were made accessible to up to 50 managers.

“The combination of researching their private lives and the ongoing recording of the activities they were engaged in led to a particularly intrusive violation of the rights of those affected,” the authority said. 

The data collection had been ongoing since at least 2014, and only became known when the information became accessible company-wide for a few hours in October 2019 due to a computing error.

H&M said they would “carefully examine the decision,” adding that “practices in the processing of employee data in Nuremberg were incompatible with H&M’s policies and instructions.”

“After the incident was discovered and reported, H&M immediately initiated far-reaching measures at the Nuremberg service center,” the company said. 

“H&M takes full responsibility and would like to express an unconditional apology to the Nuremberg employees.”

The fine is one of the highest in Europe linked to the European Union’s data protection rules, known as GDPR. 

The law, implemented in 2018, says that individuals must explicitly grant permission for their data to be used, and can impose fines on companies worth 4% of their worldwide annual revenue. 

France fined Google 50 million euros ($59 million) in January 2019 for failing to provide accessible information on its data-consent policies, calling out the internet giant’s use of targeted advertising. 

Meanwhile in July last year, British Airways was fined 183 million pounds (201 million euros, $236 million), by the United Kingdom’s data authorities after computer hackers stole bank details from hundreds of thousands of passengers. 

Germans hold privacy in high regard, as manifested in their continued high usage of banknotes and coins rather than credit cards. It is often considered to be a reaction to oppressive surveillance under the Nazis and East German Stasi.

Separately, H&M announced on Thursday it will close 350 out of its 5,000 stores worldwide as the coronavirus pandemic pushes more shoppers online. The fashion chain returned to profit in its June-August quarter, having tumbled into loss the previous 3 months at the worst of coronavirus lockdowns. – Rappler.com