Fine of EUR 35.5 million for data protection violations: Highest fine for GDPR infringements in Germany so far

The Hamburg Commissioner for Data Protection and Freedom of Information (hereinafter “Hamburg DPA”) has imposed a fine in the amount of EUR 35.5 million on a global fashion company’s subsidiary in Germany for violations of the GDPR. This fine is the highest fine imposed under the GDPR known in Germany so far.

The fashion company in question, based in Hamburg, operates a service center in Nuremberg. Pursuant to the Hamburg DPA, some of the company’s service center employees have been subject to extensive monitoring activities about their private lives for several years. Some supervisors collected and retained very detailed information obtained in conversations with their employees and floor talks about holiday experiences of employees, their health conditions including medical diagnoses, family issues as well as religious beliefs. Such information was partly digitally stored and sometimes readable by up to 50 other managers and even used in order to make employment-related decisions. The Hamburg DPA concluded that the combination of research into the employees’ private lives and the ongoing recording of the activities led to a particularly intensive interference with the data protection rights of the employees concerned.

Pursuant to the Hamburg DPA’s press release, this practice became known as the records were incidentally accessible companywide for several hours in October 2019. Upon request of the Hamburg DPA, the company cooperated with the authority and handed over the records with the respective data, which resulted in a reduction of the fine. Unfortunately, the Hamburg DPA neither referred to the specific legal bases of its fine – especially the violated GDPR provisions – nor did it justify the circumstances it has taken into account to calculate the fine in the amount of EUR 35.5 million.

More information: https://datenschutz-hamburg.de/pressemitteilungen/2020/10/2020-10-01-h-m-verfahren