Employee surveillance: French data protection authority fines major online mail order company 32 million euros

On December 27, 2023, the French data protection authority "Commission Nationale de l'Informatique et des Libertés" (CNIL) imposed a fine of 32 million euros on the French subsidiary of a large online mail order company. In the opinion of the authority, the company used a system to monitor the performance and activities of employees that disproportionately interfered with the rights of employees, in particular their right to privacy.

Background

The company operates large warehouses in France and elsewhere, where numerous items are picked and stored every day. To measure productivity, employees are equipped with scanners that allow them to be identified. These scanners can be used to record the items that are currently being processed or the locations from which items are removed or stored. Employees can also receive instructions. This enables the individual steps of an article to be tracked and employee activity to be recorded. In particular, the number of items processed by an employee in a certain period of time, the periods of inactivity or the quality level of processing are recorded. This also allows errors and error probabilities, such as items being scanned too quickly, to be identified. By recording this data, a large amount of personal data is collected, which allows statements to be made about the quality, productivity and periods of inactivity of employees.

The "quality, productivity and inactivity times" indicators of employees, which are recorded in real time, are available to line managers and are stored for 31 days.

The indicators were used to generate weekly performance reports for each employee, which included weekly, daily and hourly statistics on compliance with quality procedures, productivity and raw data on quality defects.

As a summary of the purpose of the processing, the responsible company states that the indicators are used in particular for quality assurance and safety, warehouse management, employee evaluation and the need for coaching and individual training.

Reasons for the decision

In the CNIL's opinion, the company was in breach of the General Data Protection Regulation (GDPR) by collecting, processing and storing the data so comprehensively. This was the result of a comprehensive balancing of interests between the interests of the company, in particular in ensuring security and quality, and the rights of employees. The CNIL came to the conclusion that the collection and storage of data was not necessary and excessive, in particular on the basis of the following points.

• On the one hand, scanning within seconds leads to the continuous recording of specific time periods and the direct tasks of employees, which, in the opinion of the CNIL, is likely to have a negative moral impact on employees. Moreover, this exceeds the reasonable expectations of employees, who can expect their work to be monitored to a certain extent, but cannot reasonably expect their work to be tracked to the second. This type of monitoring is not necessary for the legitimate interests of the company to ensure quality and safety in the company, as employees would be unduly affected, in particular in their right to privacy and personal life and their right to working conditions (in particular health and safety).
• Secondly, recordings of very short periods of less than ten minutes are also disproportionate, as they force employees to justify very short periods that are considered unproductive working time.
• On the other hand, the CNIL considered the recording of data in real time to optimize work processes by redeploying employees or by providing advice or support to be legitimate. As soon as a problem is identified, it can be rectified. However, it is not necessary for the individual data to be stored in detail over a period of 31 days. Rather, in the opinion of the French authority, weekly work statistics are sufficient to provide a representative overview of employee performance.
• The same also applies to work planning in the warehouse in order to be able to assess various tasks and put together suitable teams based on employee productivity statistics. This can also be done on the basis of weekly productivity statistics.
• With regard to recordings of more than ten minutes for the purpose of assessing employees and determining the necessary training requirements, a storage period of 31 days is also not necessary. The employee assessment and determination of the necessary training requirements could already be made possible by the collected productivity and quality indicators. The processing of idle times and interruptions of more than ten minutes unduly impairs the right to privacy of employees as well as the right to working conditions that respect the health and safety of employees.

Overall, the storage of 31 days was therefore not necessary and therefore disproportionate. This disregards the principles set out in Art. 5 (1) c) and 6 GDPR (principle of data minimization).

Effects

As the CNIL's decision is not yet legally binding, it remains to be seen whether and how a next instance will decide on the matter.

With regard to the legal classification of such situations in Germany, the French authority's decision is also noteworthy. The administrative court of Hanover (judgment of 9.2.2023 - 10 A 6199/20) was also based on the assessment of the permissibility of monitoring employees using hand-held scanners from the same group in a German logistics center. However, the administrative court of Hannover took the view that the use of employee data was permissible and based this in particular on the open and transparent collection and use of data and on the fact that the data fell within the employer's business area and that no special categories of data were affected (Art. 9 GDPR), see our Update No. 138.

An appeal has also been lodged against the ruling in Germany. It is desirable that a uniform legal opinion will prevail across all countries.

In any case, companies are still obliged to carry out a careful legal review of any type of employee monitoring in advance with the involvement of the relevant parties.