35m euro fine for processing data of employees’ private life

Since at least 2014 several issues concerning the private life of employees have been comprehensively recorded and stored from the company H&M at Nuremberg, Germany. This data collection became public due to a technical configuration error in October 2019.

   An example of this situation is that the company stored and exploited detailed information on the symptoms of illness and diagnoses of the employees, while some supervisors used information that they heard by accident, for instance about family problems and religious beliefs.

   Such data has been stored on the network drive, which could be accessed by up to 50 managers of the company. This network drive was used to evaluate the performance of the employees and to make employment decisions.

   As a result according to an announcement on October 1, 2020 by the Hamburg Commissioner for Data Protection and Freedom of Information, H&M is fined in the amount of 35.3 million euro for processing data concerning the private life of employees, making them available to up to 50 managers and making employment related decisions on these data. Therefore, H&M must introduce corrective measures, provide employees with damages and an apology.