H&M Hit with Record-Breaking GDPR Fine over Illegal Employee Surveillance

https://www.forbes.com/sites/carlypage/2020/10/02/hm-hit-with-record-breaking-gdpr-fine-over-illegal-employee-surveillance/

by GordonS • 6 years ago

144 50 6 years ago

forbes.com

obilgic• 6 years ago

$41.3 million? record-breaking maybe, but won't make a dent

thomasahle• 6 years ago

Either they change it, or they just get a bigger fine in a year or so.

Germany is really the world leader in personal liberty / privacy.

swarnie_• 6 years ago

Germany is really the world leader in personal liberty / privacy.
"After absences such as vacations and sick leave the supervising team leaders conducted so-called Welcome Back Talks with their employees. After these talks, in many cases not only the employees' concrete vacation experiences were recorded, but also symptoms of illness and diagnoses,”

Are you sure? That sounds very Americanesk dystopian to me.

GordonS2• 6 years ago

Hopefully the bad publicity over this will also help to force them to change their behaviours.

tgsovlerkhgsel• 6 years ago

Previous discussion: https://news.ycombinator.com/item?id=24650634

mabbo• 6 years ago

parts of the workforce had been subject to "extensive recording of details about their private lives".
"After absences such as vacations and sick leave the supervising team leaders conducted so-called Welcome Back Talks with their employees. After these talks, in many cases not only the employees' concrete vacation experiences were recorded, but also symptoms of illness and diagnoses,”

I'm trying to come up with any legal, ethical reason to want to have and keep records on this. Every manager collecting these records has to somehow justify to themselves that this is okay, and I can't fathom how.

save_ferris• 6 years ago

It would be pretty easy for them to convince themselves that collecting this data would be helpful for loss-prevention, keeping quotas up, whatever. It doesn’t even have to be true.

Many employers take advantage of the power they have over employees. The real outrage to me is how this is definitely happening in the US and we have no way to combat it.

whimsicalism2• 6 years ago

I mean even labor laws on the book are hardly enforced in the United States.

pessimizer• 6 years ago

Managers just have to do what they're told or find another job. This is another example of OCD from above (like most data dragnets.) When prevention costs 10x more than the disease.

Silhouette2• 6 years ago

Managers just have to do what they're told or find another job.

I'm not sure that's true, at least not in a healthy company. Still, if those are the only options and what they're told to do breaks the law, which option do you think they should choose?

European countries tend to have quite strong employee protections in law, so anyone who did end up quitting over something like this might get some compensation as well.

walshemj• 6 years ago

The after annual leave aspect is the amazing thing.

GordonS2• 6 years ago

The after annual vacation thing is particularly bizarre - on on earth would anyone think it was appropriate to formally ask for an collect this information? This was done at scale, so many people were involved - I also don't understand how none of them decided to turn whistleblower before now.

jfoster2• 6 years ago

I'm trying to come up with any legal, ethical reason to want to have and keep records on this.

What's even the non-legal, non-ethical point of recording employees' vacation experiences? Feel like I'm missing something.

MereInterest• 6 years ago

Illegal and unethical thought processes:

* Do I think this employee has a chronic illness that will them have future absences?

* Is this employee a woman expecting to have more kids, and will that cause future absences?

* Is this employee visiting family out of state? If so, they might want to move to that state in the future. (Acceptable vacation locations include Disneyland, Paris, and anywhere with beaches.)

Illegal and unethical response: If the answer to any of the above is "yes", then slightly rank them lower than coworkers, avoid giving them important projects, and be on the lookout for unrelated reasons to fire them.

bserge• 6 years ago

That was the norm where I worked in the UK, as well. Seemed a bit excessive. Everyone just lied.

mrkwse• 6 years ago

Worth noting that while it's the largest fine from the German regulator, it's only the fourth highest across Europe. The UK's ICO have issued fines of ~€205m and ~€110m to British Airways and Marriott Intl. respectively, while France's CNIL have fined Google €50m. H&M were only fined ~€35m.

eeZah7Ux• 6 years ago

"record-breaking" and it's not even a slap on the wrist.

nairboon• 6 years ago

A record-breaking 0.3% of their 2019 gross profit.

tomalpha• 6 years ago

I can imagine they have tight margins. This might be more painful than an apparently small percentage might appear.

black_puppydog2• 6 years ago

Their profit was $1.5B last year. $41M is less than 3% of that. Not nothing, for sure. But the GDPR allows for up to what, 4% of revenue? Their revenue was $24.3B. That would have been $970M in fines then. H&M got a slap on the wrist. Just like all the other companies before them.

Someone• 6 years ago

I haven’t looked up their gross profit, but https://www.statista.com/statistics/252191/profit-of-the-h-u...: “In 2019, the global operating profit of the H&M Group was about 1.8 billion U.S. dollars.”

⇒ it’s about 2% of their global profits, for something some they did in Germany. Reading https://www.statista.com/statistics/252187/sales-of-the-hund..., it seems their German revenues are about 20% of global revenues, so I would guess it’s about 10% of their profits made in Germany.

throw_m239339• 6 years ago

I don't understand why people keep on implying it's not a big deal. $41M is a lot of money, even for H&M. These corporations didn't become what they are by not being extremely stingy and greedy trying to squeeze up to the last penny that can be squeezed. Here it's certainly not "the cost of doing business".

Grollicus• 6 years ago

I don't understand why people keep bringing this up. This was misbehavior in one of their stores. (Or whatever is a H&M "Service Center"?) One store will never be in the billions in profits - they will have to work for quite some time at that location to earn that fine back.

jpgvm• 6 years ago

I take issue with their response, quoted below:

A comprehensive action plan has been launched to improve the internal auditing practices to ensure data privacy compliance, strengthen leadership knowledge to assure a safe and compliant work environment, and continue to train and educate both staff and leaders in this area

How is the response to this incident to try prevent further breaches rather than vowing to not collect this data in the first place? Why is this an acceptable response at all?

tortasaur• 6 years ago

I don't read this as saying they'll prevent further breaches. It seems to be saying that they will improve compliance with data privacy regulation.

jameshart2• 6 years ago

Right, collecting the data in the first place was a compliance breach.

We're so used to the only kind of data protection enforcement being for data leakage - but this is actually a great example of what GDPR is really for: putting a framework around what personal data it's acceptable for companies to process in the first place.

annoyingnoob• 6 years ago

I'm with you, the process of collecting this data is the issue. This issue shouldn't be about compliance and audits, it should be about not intruding into the lives of your employees. I would never work for a company that treated me that way.

barkingcat• 6 years ago

It's cause they want to collect even more data, and they promise to keep it all safe.

inakarmacoma• 6 years ago

How did they even accomplish this level of monitoring/spying? I'm imagining GPS, webcam, and drones. Surely that can't be right?

H&M Hit with Record-Breaking GDPR Fine over Illegal Employee Surveillance

Related Stories