On October 1, 2020, the Hamburg Data Protection Authority (“Hamburg DPA”) fined H&M, the Swedish clothing company, over €35 million for illegally surveilling employees at its service center in Nuremberg.  This fine is the largest financial penalty issued by a German DPA to date for a violation of the European General Data Protection Regulation (“GDPR”), and the second highest in Europe issued by any DPA (although other DPAs have announced their intention to issue other larger fines).

According to a statement issued by the Hamburg regulator, H&M acquired “extensive recordings of the private-life circumstances” of several hundred employees at the service center since 2014.  This information included details of employees’ holiday experiences, symptoms of illness and diagnoses, family issues and religious beliefs.  H&M recorded this information during one-on-one “Welcome Back Talks” following periods of sick leave or vacation, as well as during additional one-on-one meetings and corridor discussions.  The company permanently saved the information on a network drive that “up to 50 other managers” could access.  H&M used all of this information in “meticulous” performance evaluations; more broadly, it served to “obtain a profile of the employees for measures and decisions in the employment relationship”.

As with so many compliance failings, this issue came to light because of a security breach.  H&M discovered a security breach in October 2019 when a configuration error made the information about employees accessible, company-wide, for several hours.  On learning about the breach, the Commissioner of the Hamburg DPA ordered that the contents of the network drive be frozen and subsequently released.  The DPA then initiated an investigation.

In its announcement about the decision, the Hamburg DPA stated that the combination of research into employees’ private lives and the ongoing recording of activities led to a “particularly intensive interference” with employees’ rights.  He also added that the amount of the fine was appropriate to deter companies from similar privacy violations.

In an online statement, H&M said it will review the decision carefully.  Meanwhile, it has issued an apology to all employees affected and announced that those employed at the service center for at least one month since May 2018, when the GDPR came into force, will receive financial compensation.  We will continue to monitor developments.

Photo of Helena Milner-Smith Helena Milner-Smith

Helena Milner-Smith helps companies navigate complex international HR-legal compliance issues.

Helena advises clients across a range of industries on all aspects of UK and international employment law, including the HR aspects of privacy compliance and human rights regulation.

Helena has particular expertise advising…

Helena Milner-Smith helps companies navigate complex international HR-legal compliance issues.

Helena advises clients across a range of industries on all aspects of UK and international employment law, including the HR aspects of privacy compliance and human rights regulation.

Helena has particular expertise advising on the HR-legal aspects of multi-jurisdictional transactions. She also regularly assists clients seeking to protect their business and increase international compliance by designing and implementing global policies, employment contracts and restrictive covenants.

Helena has been recognised by Legal 500 UK for her “exceptional service” and “responsive and practical” advice.

In addition, Helena has gained valuable in-house experience while on secondment at three large multinational corporations – a pharmaceutical company, an oil company and a leading investment bank

Photo of Lars Lensdorf Lars Lensdorf

Lars Lensdorf is a partner in the Frankfurt office. He focuses on IT law, outsourcing, digitalization/ industry 4.0, IT related bank regulatory matters and data protection. Dr. Lensdorf’s practice covers all types of IT and outsourcing agreements, all matters of digitalization and industry…

Lars Lensdorf is a partner in the Frankfurt office. He focuses on IT law, outsourcing, digitalization/ industry 4.0, IT related bank regulatory matters and data protection. Dr. Lensdorf’s practice covers all types of IT and outsourcing agreements, all matters of digitalization and industry 4.0, including online procurement platforms, IT-compliance matters (including cybersecurity) as well as data protection.

Furthermore, he is also focused on interfaces to other practice areas to the extent that IT related matters are affected, e. g. regulatory requirements for banking and financial services as well as public procurement law. A significant part of Dr. Lensdorf’s practice is currently advice in connection with the implementation of the GDPR (data protection) in Europe.

Stacy Young

Stacy Young is a trainee solicitor who attended the University of Law.

Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.