Enforcement · Data Protection Authority of Hamburg EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

H&M Hennes & Mauritz Online Shop A.B. & Co. KG: Insufficient legal basis for data processing

€35,258,708 Fine
H&M Hennes & Mauritz Online Shop A.B. & Co. KG
GERMANY
Art. 5 GDPR Art. 6 GDPR
Religious Beliefs Human Resources Employees Supervisory Authorities Privacy by Design & Default Processing Special Categories of Data Authority Powers for Fundamental Rights Protection
Oct 1, 2020 Source

How it connects

Related across sources

Literature If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Computer law & security review Guidance Art. 29 WP Guidelines on GDPR transparency requirements (WP260 rev.01) EDPB Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Guidance Guidelines 01/2022 on data subject rights - Right of access EDPB Guidance Guidelines 07/2022 on certification as a tool for transfers EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB

Full text

The fashion company with seat in Hamburg operates a service center in Nuremberg. Here, according to the findings of the Hamburg data protection officer, since at least 2014 private life circumstances of some of the employees have been comprehensively recorded and this information stored on a network drive. For example, the company conducted a 'Welcome Back Talk' after employees returned to work after vacation or illness. The information that became known in this context - including information on the symptoms of illness and diagnoses of the employees - was recorded and stored. In addition, according to the Hamburg data protection authority, some supervisors also used the 'Flurfunk' [meaning to hear something through the grapevine] to acquire a broad knowledge of individual employees, for example about family problems and religious beliefs. The information stored on the network drive was accessible to up to 50 managers of the company and was used, among other things, to evaluate the work performance of the employees and to make employment decisions.The data collection became known due to a technical configuration error in October 2019, according to which the data stored on the network drive was accessible company-wide for several hours. After the violation became known, the management apologized to the employees and offered monetary compensation. In addition, also further protective measures were introduced together with the data protection authority. [Note: Concrete legal basis of the fine not yet published - we assume this will mainly be Art. 5 and 6 GDPR]

Industry: Employment

Original document at the source datenschutz-hamburg.de

Similar Content