H&M Fined €35.2m for GDPR Violations

The world’s second-biggest fashion retailer was today handed a monumental fine for violating the European Union’s General Data Protection Regulation (GDPR).

A German subsidiary of Hennes & Mauritz AB (H&M) was fined €35,258,707.95 by regulatory body the Hamburg Data Protection Authority (HmbBfDI) for excessive use of employee data. H&M employs around 126,000 people globally.

The fine imposed on H&M Hennes & Mauritz Online Shop A.B. & Co KG is the largest to be levied so far against a company for GDPR violations involving how employee data is handled.

“We are likely to see more pressure on employers to justify the handling of employee data as a result of today’s fine,” commented Jonathan Armstrong, partner at Cordery Legal Compliance.

HmbBfDI launched an investigation into H&M’s Service Center in Nuremberg after a 2019 data breach caused by a configuration error revealed how much data H&M Germany was collecting about the private lives of its employees.

The authority found that since at least 2014, H&M had been collecting and storing on its company network copious amounts of data concerning their employees’ holiday experiences, family issues, religious beliefs, and symptoms of illness and diagnoses.

The data was collected during one-to-one conversations between employees and their supervisors and during “welcome back talks” held between employees and team leaders after an absence from work. Some of the data was accessible by up to 50 other managers.

After evaluating 60GB of H&M data and reviewing witness evidence and the company’s internal procedures, HmbBfDI ruled that “the combination of collecting details about their private lives and the recording of their activities led to a particularly intensive encroachment on employees’ civil rights.”

H&M subsequently apologized to its employees. Today the company confirmed that financial compensation would be given to everyone employed at the impacted entity since May 2018, when GDPR became law.

News of the financial penalty comes as the Swedish multinational clothing company announced plans to close 250 of its stores globally. The company said the closures, scheduled to take place in 2021, are driven by customers’ showing a marked preference for shopping online.

The firm has 5,000 stores worldwide, 166 of which are currently closed due to restrictions put in place to slow the spread of COVID-19.