H&M

What happened

The Hamburg DPA fined H&M €35.3 million for extensive surveillance of its employees at its Nuremberg service center. Managers conducted detailed interviews with returning employees after absences, recording information about vacations, illnesses (including symptoms and diagnoses), family problems, and religious beliefs. This data was stored on a shared network drive accessible to over 50 managers.

Articles violated

Lessons learned

Employee monitoring must be proportionate and limited to what is necessary. Recording employees' health data, religious beliefs, and personal life details violates data minimization principles. Access controls on sensitive data must be strictly limited. Companies should implement clear policies on what employee data can and cannot be collected.