Largest fine yet levied against employer for breach of GDPR regulations concerning employee data

The German branch of the Swedish clothing manufacturer H&M have been handed a huge fine in excess of €35 million by the Hamburg Data Protection Authority, as a result of a breach of GDPR rules concerning employee data. The fine is the largest levied against an employer for a breach of this kind since the implementation of GDPR in 2018.

Following an investigation it was found that data had been collected and stored on the company network relating to a number of personal issues, including; employees holiday experiences, their religious views, family issues and symptoms/diagnoses of illnesses since at least 2014. The data was collected during one-on-one meetings following employees return from absence and was accessible by up to 50 other managers.

H&M have issued an apology to its employees and will provide financial compensation to everyone employed at the firm since May 2018, when GDPR came into force.