Employee monitoring: French SA fined Amazon France Logistique €32 million

Background information

• Date of final decision: 27 December 2023
• Cross-border case or national case: national case  
• Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject), Article 32 (Security of processing)
• Decision: Administrative fine
• Key words: Employment, Lawfulness of processing, CCTV, Data security, Data minimisation

Summary of the Decision

Origin of the case  

Amazon France Logistique manages the Amazon group's large warehouses in France, where it receives and stores items and then prepares parcels for delivery to customers. 
As part of its activities, each warehouse employee is given a scanner to document the performance of certain tasks assigned to them in real time (storage or removal of an item from the shelves, putting away or packing, etc.). Each scan carried out by employees results in recording of data, which is stored and used to calculate indicators providing information on the quality, productivity and periods of inactivity of each employee. 
Following press articles about practices of the company in its warehouses, the French Supervisory Authority (SA), carried out several investigations. It also received several complaints from employees.

Key Findings 

The French SA found several breaches of the GDPR regarding:

1. Warehouse stock and order management:
   • Failure to comply with the principle of data minimisation (Article 5.1.c GDPR).
   • Failure to ensure lawful processing (Article 6 GDPR) by using three indicators which are illegal:
     • the "Stow Machine Gun" indicator, which signals an error when an employee scans an item "too quickly" (i.e. in less than 1.25 second after scanning a previous item); 
     • the "idle time" indicator, which signals periods of scanner downtime of ten minutes or more;
     • the "latency under ten minutes" indicator, which signals periods of scanner interruption between one and ten minutes.
       The French SA noted that the processing of these three indicators could not be based on legitimate interest, as it led to excessive monitoring of the employee regarding the objective pursued by the company. 
        
2. Work schedule and employee appraisal:
   • Failure to comply with the principle of data minimisation (Article 5.1.c GDPR). The work schedule in the warehouses, along with the assessment and training of the employee do not require access to every detail of the data and statistical indicators provided by the scanner used by the employee and reported over the last month.
   • Failure to comply with the obligation to provide information and transparency (Articles 12 and 13 GDPR).
      
3. Video surveillance processing:
   • Failure to comply with the obligation to provide information and transparency (Articles 12 and 13 GDPR).
   • Failure to the obligation to ensure security of personal data (Article 32 GDPR).

Decision 

The French SA imposed a fine of EUR 32M€ on Amazon France Logistique.

For further information: 

• Surveillance des salariés : la CNIL sanctionne AMAZON FRANCE LOGISTIQUE d’une amende de 32 millions d’euros (fr)
• Employee monitoring: CNIL fined AMAZON FRANCE LOGISTIQUE €32 million (en)