H&M — €35.3M GDPR fine (2020)

Secret employee profiling — managers logged personal details after 1:1s

What happened

Hamburg's data-protection authority fined H&M €35.3M after a misconfigured network drive exposed years of detailed records on hundreds of Nuremberg service-center employees — including health conditions, family issues, religion, and vacation experiences captured by managers after 'welcome-back' chats.

Root cause

• No lawful basis under Art. 6 / Art. 9 for sensitive-data processing
• No transparency to employees about data collection
• Misconfigured share made data internally world-readable

What every team should do

1. Employee monitoring requires explicit, narrow legal basis and documented DPIA
2. Sensitive-category data (health, religion) needs Art. 9 condition + heightened safeguards
3. Audit fileshare ACLs quarterly — exposed shares are the most common GDPR breach vector

Related enforcement actions