CNIL fined Amazon France Logistique!
Introduction
On December 27, 2023, the French Data Protection Authority (CNIL) fined AMAZON FRANCE LOGISTIQUE €32 million. This was due to the company’s use of excessively intrusive technology to monitor employee activities and performance. Furthermore, the corporation was penalised for using video monitoring without giving necessary information or security safeguards.
Allegations
As part of their responsibilities, every warehouse employee is given a scanner to document the completion of certain tasks allocated to them in real-time. These chores include operations such as storing or removing objects from shelves, packing or putting items away, and so on.
Every time an employee scans an item, the information is recorded and saved. This data is then utilised to produce a variety of indicators that offer information on the employee’s productivity, job quality, and times of inactivity.
- The CNIL found that implementing a system that precisely tracks work interruptions or inactivity exceeding 10 minutes (idle time) is illegal as it requires employees to justify each break or interruption.
- Second, the CNIL determined that the mechanism for evaluating the speed with which things were scanned was likewise excessive. “Stow machine guns” determine if an item was scanned in less than 1.25 seconds after the previous one, based on the idea that scanning objects too rapidly increases the likelihood of inaccuracy.
- Finally, the CNIL said that it was excessive to retain all of the data acquired by the system, as well as the resultant statistical indicators for all employees and temporary workers, for 31 days.
The company had several thousand employees, and the system believed to have constraints employees through computer monitoring contributed to the company’s economic gains, giving Amazon an edge over other online sales companies. However, this instead put employees under constant pressure.
Fine
The CNIL, the regulatory authority in charge of enforcing fines, has fined Amazon France Logistics €32 million. This fine represents around 3% of the company’s yearly sales, which was 1.1 billion euros in 2021. Amazon France Logistique also reported a net profit of 58.9 million euros.
GDPR Violations
- Data Minimization Principle (Article 5.1.c): Amazon France Logistics failed to comply with the data minimization principle by allowing excessive access to quality and productivity metrics acquired by scanners. The restricted committee believes that real-time help or work reassignment does not require extensive access to a month’s worth of employee data.
- Unlawful Processing (Article 6): The restricted committee considers three metrics handled by the corporation, including the “Stow Machine Gun,” “idle time,” and “latency under ten minutes,” unlawful. Despite accepting the necessity for accurate monitoring, the committee maintains that these indications, which lead to excessive surveillance and possible reasons for interruptions, cannot be founded on legitimate interest.
- Data Minimization Principle (Article 5.1.c): The restricted committee discovers violations in the work schedule and employee assessment, stating that access to every detail of scanner data reported in the previous month is unnecessary. It implies that statistics per employee summed weekly, are sufficient for measuring mastery, team creation, and identifying training requirements.
- Failure to Provide Information and Transparency (Articles 12 and 13): Until April 2020, temporary workers were not fully informed about scanner data collecting privacy practices, which violated GDPR duties.
- Failure to ensure security of personal data (Article 32): The restricted committee observes that employees and external visitors are not given enough information about video surveillance devices. Furthermore, the absence of security in video surveillance software, with weak passwords and shared access accounts, raises worries about data security and traceability.
CNIL fined Yahoo! €10 million
Introduction
Complaints
Allegations and GDPR Violations:
- Cookies Deposited Without User’s Consent. As part of its investigation, the French CNIL, determined that Yahoo EMEA Limited placed around twenty cookies for advertising purposes on the “Yahoo.com” website without specific consent. The cookie banner, which was supposed to seek consent, proved ineffectual in preventing unauthorised cookie insertion.
- Incentive Not to Withdraw Consent. The committee discovered that Yahoo EMEA Limited made it difficult for users to revoke their permission to cookies on the “Yahoo! Mail” messaging service. Users who sought to do so were informed that they would lose access to the company’s other services, including its messaging service.
- Lack of Alternative Options and Freedom of consent exercises. The committee has emphasised that, while it is appropriate to ask users to register cookies to access a service, such permission must be supplied voluntarily. Yahoo EMEA Limited provided no alternative choices to consumers who refused to grant their consent.
These users had just one option: give up their ability to utilise the texting service.
- Email Address as a Privacy Element. The committee emphasised the value of email addresses in consumers’ personal life. Email addresses facilitate communication, networking, and the preservation of critical discussions. Users find it challenging to transition to similar services since email addresses are irreplaceable.
Author:
Harmanpreet Kaur, Fourth Year Law Student and Legal Intern Data Privacy and Digital Law at EU Digital Partners
