H&M Fined €35.2m for GDPR Violations

Blog Layout

H&M Fined €35.2m for GDPR Violations

Leo Daniels • Oct 06, 2020

This is a subtitle for your new post

The world’s second-biggest fashion retailer was today handed a monumental fine for violating the European Union’s General Data Protection Regulation (GDPR).

A German subsidiary of Hennes & Mauritz AB (H&M) was fined €35,258,707.95 by regulatory body the Hamburg Data Protection Authority (HmbBfDI) for excessive use of employee data. H&M employs around 126,000 people globally.

The fine imposed on H&M Hennes & Mauritz Online Shop A.B. & Co KG is the largest to be levied so far against a company for GDPR violations involving how employee data is handled.

“We are likely to see more pressure on employers to justify the handling of employee data as a result of today’s fine,” commented Jonathan Armstrong, partner at Cordery Legal Compliance.

HmbBfDI launched an investigation into H&M’s Service Center in Nuremberg after a 2019 data breach caused by a configuration error revealed how much data H&M Germany was collecting about the private lives of its employees.

The authority found that since at least 2014, H&M had been collecting and storing on its company network copious amounts of data concerning their employees’ holiday experiences, family issues, religious beliefs, and symptoms of illness and diagnoses.

The data was collected during one-to-one conversations between employees and their supervisors and during “welcome back talks” held between employees and team leaders after an absence from work. Some of the data was accessible by up to 50 other managers.

After evaluating 60GB of H&M data and reviewing witness evidence and the company’s internal procedures, HmbBfDI ruled that “the combination of collecting details about their private lives and the recording of their activities led to a particularly intensive encroachment on employees’ civil rights.”

H&M subsequently apologized to its employees. Today the company confirmed that financial compensation would be given to everyone employed at the impacted entity since May 2018, when GDPR became law.

News of the financial penalty comes as the Swedish multinational clothing company announced plans to close 250 of its stores globally. The company said the closures, scheduled to take place in 2021, are driven by customers’ showing a marked preference for shopping online.

The firm has 5,000 stores worldwide, 166 of which are currently closed due to restrictions put in place to slow the spread of COVID-19.

We’re 1-fix, we can help you secure your business

At 1-fix, we take a realistic approach to technology – ensuring our client’s systems are best protected.

If you have any concerns, questions or simply want to explore how to better secure your business, please do get in touch with the team for a FREE demonstration, consultation to explore how exposed your business might be and identify actions to take.

< Older Post

Newer Post >

Join Our Mailing List

All sign-ups are handled inline with our privacy policy and can unsubscribe at any time.

Recent Blogs

MSP of the Year 2024!

By Jess Dugdale • 01 May, 2024

We won MSP of the Year 2024 (sub 1500 endpoints)!

Why is outsourcing your IT Support a good thing?

By Craig Atkins • 22 Apr, 2024

Are you tired of juggling IT issues while trying to focus on growing your business? It may be time to consider outsourcing your IT support. We've put together 5 reasons why outsourcing your IT can be beneficial for you...

What is Microsoft Copilot and how can it boost your productivity?

By Grant Davis • 03 Apr, 2024

In today’s fast-paced digital landscape, having an intelligent assistant by your side can make all the difference. Enter Microsoft Copilot, a powerful AI companion designed to boost productivity, spark creativity, and simplify complex tasks. Let’s dive into what makes Copilot a game-changer for individuals and businesses alike.