Amazon France Logistique – €32,000,000 Fine (France, 2023)

In November 2019, the French DPA ("CNIL") carried out inspections on the premises of Amazon France Logistique (“controller”) to apprehend the processing of employee's personal data via scanners and video surveillance. The CNIL discovered that when an employee was assigned to a direct task, they were equipped with a scanner, enabling them to identify themselves, receive instructions, scan labels of the items they were processing etc. This allowed the controller to continuously collect data relating to the activity of employees assigned to direct tasks making it possible to measure the employee’s activity, in particular by counting the number of units they process over a given period. Inactivity indicators were reported in real time for each employee. One of the indicators named Stow Gun Machine allowed the controller to monitor each gesture performed by the employee in each direct task assigned to them, by associating with it an error indicator each time their speed was less than 1,25 seconds. These indicators were stored for 31 days and could be consulted both via raw data and in the form of statistics. Weekly performance reports were drawn up for each employee on the basis of the indicators collected, and contained weekly, daily and hourly statistics on compliance with quality procedures and productivity. Following the on-site inspections, numerous exchanges took place between the CNIL and the controller, from November 2019 to January 2021. The CNIL started a sanctioning procedure against the controller on 28 January 2021. Preliminarily, the CNIL established that Amazon France Logistique was the controller under Article 4(7) GDPR. The DPA considered that the determination of processing was linked to Amazon’s French human resources management. Although the employee management process is based on a common framework for the entities of Amazon group, they are subject to local adaptations decided autonomously by the local branches of the controller. The CNIL considered that Amazon France Logistique was free to adapt the criteria developed at a group level to assess the performance of employees working and to install video surveillance cameras in its warehouses and was therefore the controller. The processing was not cross-border meaning that the French DPA did not have to invoke Article 60 GDPR and were competent to decide the decision on their own. The French DPA considered themselves competent because (i) the processing of employees’ personal data was carried out in the context of the activities of the activities of the controller, which has its registered office in France and (ii) the processing in question was carried out in the context of the controller's activities and it affects or is likely to affect only employees working in the company's warehouses located in France. Firstly, Article 6(1)(f) GDPR establishes that processing is lawful if it is necessary for the legitimate interests pursued by the controller, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject. The CNIL noted that given the nature of the processing in question the legal bases provided by Article 6(1)(a) to (e) GDPR could not apply. Consent could not apply in this case because of the imbalance in the employer-employee relationship. Therefore, the DPA indicated that the data processing could only be based on legitimate interest, as long as it did not disproportionately affect the rights, freedoms and interests of employees. The CNIL noted that the Stow Gun Machine indicator processing was likely to have moral repercussions on the employees and the inactivity indicators were linked to the identity of each employee which, in practice, forced employees to be able to justify any time considered to be non-productive. The DPA considered that these measures were highly intrusive and therefore could not be based on Article 6(1)(f) GDPR. Secondly, Article 5(1)(c) GDPR indicates that personal data should be adequate, relevant and limited to what is necessary regarding the purposes (data minimisation). The CNIL also noted that the processing failed to comply with Article 5(1)(c) GDPR regarding the processing of quality and productivity indicators for the purposes of reassigning and coaching employees in real time, the processing carried out for week planning purposes and the processing for the purpose of employee assessments. The CNIL considered that keeping and accessing all this raw data used for these purposes was not necessary. Thirdly, the controller had violated the informational requirements contained in Article 12 GDPR and Article 13 GDPR. The CNIL noted that until April 2020, temporary workers were not given the privacy policy applicable in human resources, nor were they invited to familiarize themselves with it on the intranet. The DPA considered that putting the information regarding processing on the intranet for employees working in warehouses who were not intended to work on an office computer did not constitute a satisfactory means of information. Fourthly, the CNIL considered that the data controller failed to comply with Article 13 GDPR regarding video surveillance since the controller did not provide an indication of how long the data would be kept, the right to lodge a complaint with the CNIL and the contact details of the DPO. Furthermore, Article 32 GDPR states that the controller must ensure a level of security appropriate to the risk. Regarding video surveillance, the CNIL considered that the lack of access traceability due to the use of a shared account complicated investigation work in the event of a fraudulent access, deterioration or deletion of images. The DPA added that the password for accessing the video surveillance software was insufficiently robust and could lead to attacks by unauthorized parties. The CNIL also noted that the authentication of authorized persons to an individual Windows account prior to their connection to the video surveillance software was not sufficient to compensate for the vulnerabilities resulting from the access to the software from a shared account and using an insufficiently robust password. Consequently, the CNIL considered these facts to constitute a breach of Article 32 GDPR. In view of all the violations, the CNIL decided to impose an administrative fine of €32 million.