4 ms·

> The weird thing about this case is that it was completely informal data collection, about employees by their mid-level managers. The article says that "H&M c

> The weird thing about this case is that it was completely informal data collection, about employees by their mid-level managers. The article says that "H&M collected information on illnesses [...]". Data concerning health is among the Article 9 special categories of personal data [1], the processing of which is generally prohibited, with only a few exceptions. I'm all but certain that a mid-level manager collecting this data does not fall under any of the exceptions. [1] https://gdpr.eu/article-9-processing-special-categories-of-personal-data-prohibited/ https://gdpr.eu/article-9-processing-special-categories-of-p...

jacquesm 6y ago
It's pretty much an as open-and-shut of a clear violation of having consent and a right to process that data as you could come up with. They got off light in my view but then again, it is a first time offense so maybe not all that light.
mongol 6y ago
You are most certainly right. But I think parent's point was that informal data gathering on mid manager level is a difficult thing to protect yourself from, as a large corporation. Any clueless manager can open an Excel file and type in personal information about their reports. Training and policies can help, but not completely prevent. When you build larger software systems you can have audit processes in place etc. But the informal level is tricky..
- germanier 6y ago
  In this case they seem to have collected 60 GB data shared among 50 managers. It's interesting that no one raised an issue. It only became known after the network share was made visible to more people by mistake.
  - 542354234235 6y ago
    That clearly rises well above the level of “someone entered personal data into a spreadsheet”. At that level it is absolutely a negligent failure of the company to A. train and educate its managers, and B. audit operations to shut down activities like this.
- ckastner 6y ago
  In the eyes of regulators, you're expected to clue in the clueless. Training people in basic IT security is difficult, too, but it's still done. Of course the results aren't going to be perfect, but at least most people will then understand that writing down a password on a post-it under a keyboard is a no-no.
- jacquesm 6y ago
  Awareness program and an annual refresher aimed at H&M middle management level imminent. That's a lot cheaper than these fines would be.
  - nickff 6y ago
    Well, the problem is that to be consistent (and safe), you'd have to do a similar training for every possible offense. GDPR is top-of-mind for HN readers, but any large company is likely constantly violating at least dozens, if not hundreds or thousands of regulations. Ask any corporate lawyer how you could avoid violating any regulation or law, and they will just give you a blank stare, or tell you it's impossible.
    - jacquesm 6y ago
      Very few laws have as many teeth in them for corporations as the GDPR does, it was designed with that particular aspect in mind. The EU bureaucrats have a personal stake in the outcome so that definitely helped to focus them.
      - nickff 6y ago
        I suppose you're right that companies should weigh their efforts in favor of complying with laws that bureaucrats are personally invested in. That said, I see this as a rather sad state of affairs.
mytailorisrich 6y ago
And the first of these exceptions is employment. That's quite reasonable because an employer keeps track of employees' absence for health reasons and will come to know some details in case of serious health problems/long absences. In this case they collected data after sick leaves, but (a) it seems they collected quite a bit of information regarding private life, perhaps more than could be deemed reasonable and (b) the data leaked because they did not secure it properly. This sort of files on employees used to be very common. Regulations have made them 'tricky' especially if managed "as it's always been done" without expert, up-to-date, input on what's allowed and acceptable, and how to keep it secure, which seems to have happened at H&M... So definitely a failure of the company management and I'm sure that all managers have been put through compulsory training since with a very clear message that ignoring it means instant dismissal.
- tremon 6y ago
  an employer keeps track of employees' absence for health reasons That works differently in Europe. Employee health is a personal matter, and the employer does not get automatic access to that information. The employer can get a dedicated physician (affiliated but not employed by your employer) to assess your illness and guide you back to work, but even then the physician's records are off-limits to the employer. Speaking only for NL here, but I think the regulation is the same EU-wide. When you call in sick, you are not obligated to answer any questions from your employer except: - whether the cause of the illness is (or might be) work-related - how much time you expect to be out - discuss a next moment of contact (phone appointment or presence in the office) Any data regarding the illness itself is off-limits for the employer, you are allowed to volunteer the information but the employer strictly isn't even allowed to ask.
  - mytailorisrich 6y ago
    I am writing from Europe. I am not suggesting that an employer has access to employees' medical records. However, the fact is that employers will reasonably keep track of sicks leave and will in practice (and quite reasonably) have knowledge of health information very often including the illness. Personally, I think things start to go too far. Saying that "employee health is a personal matter" is going too far. Intimate details are of course personal and people may not want to share too much (and that's fine) but an employee's health insofar it impacts their job very much concerns the employer, but it must be handled lawfully, reasonably, and tactfully by them. If the employer has a clear picture it is not necessarily negative for the employee as it means that the employer can adapt and take the appropriate supportive action. I think that the legislator recognises this, seeing that employment is an exception to the GDPR's ban on health information processing (obviously without reason).

jacquesm 6y ago

It's pretty much an as open-and-shut of a clear violation of having consent and a right to process that data as you could come up with. They got off light in my view but then again, it is a first time offense so maybe not all that light.

mongol 6y ago

You are most certainly right. But I think parent's point was that informal data gathering on mid manager level is a difficult thing to protect yourself from, as a large corporation. Any clueless manager can open an Excel file and type in personal information about their reports. Training and policies can help, but not completely prevent. When you build larger software systems you can have audit processes in place etc. But the informal level is tricky..

germanier 6y ago
In this case they seem to have collected 60 GB data shared among 50 managers. It's interesting that no one raised an issue. It only became known after the network share was made visible to more people by mistake.
- 542354234235 6y ago
  That clearly rises well above the level of “someone entered personal data into a spreadsheet”. At that level it is absolutely a negligent failure of the company to A. train and educate its managers, and B. audit operations to shut down activities like this.
ckastner 6y ago
In the eyes of regulators, you're expected to clue in the clueless. Training people in basic IT security is difficult, too, but it's still done. Of course the results aren't going to be perfect, but at least most people will then understand that writing down a password on a post-it under a keyboard is a no-no.
jacquesm 6y ago
Awareness program and an annual refresher aimed at H&M middle management level imminent. That's a lot cheaper than these fines would be.
- nickff 6y ago
  Well, the problem is that to be consistent (and safe), you'd have to do a similar training for every possible offense. GDPR is top-of-mind for HN readers, but any large company is likely constantly violating at least dozens, if not hundreds or thousands of regulations. Ask any corporate lawyer how you could avoid violating any regulation or law, and they will just give you a blank stare, or tell you it's impossible.
  - jacquesm 6y ago
    Very few laws have as many teeth in them for corporations as the GDPR does, it was designed with that particular aspect in mind. The EU bureaucrats have a personal stake in the outcome so that definitely helped to focus them.
    - nickff 6y ago
      I suppose you're right that companies should weigh their efforts in favor of complying with laws that bureaucrats are personally invested in. That said, I see this as a rather sad state of affairs.

mytailorisrich 6y ago

And the first of these exceptions is employment. That's quite reasonable because an employer keeps track of employees' absence for health reasons and will come to know some details in case of serious health problems/long absences. In this case they collected data after sick leaves, but (a) it seems they collected quite a bit of information regarding private life, perhaps more than could be deemed reasonable and (b) the data leaked because they did not secure it properly. This sort of files on employees used to be very common. Regulations have made them 'tricky' especially if managed "as it's always been done" without expert, up-to-date, input on what's allowed and acceptable, and how to keep it secure, which seems to have happened at H&M... So definitely a failure of the company management and I'm sure that all managers have been put through compulsory training since with a very clear message that ignoring it means instant dismissal.

tremon 6y ago
an employer keeps track of employees' absence for health reasons That works differently in Europe. Employee health is a personal matter, and the employer does not get automatic access to that information. The employer can get a dedicated physician (affiliated but not employed by your employer) to assess your illness and guide you back to work, but even then the physician's records are off-limits to the employer. Speaking only for NL here, but I think the regulation is the same EU-wide. When you call in sick, you are not obligated to answer any questions from your employer except: - whether the cause of the illness is (or might be) work-related - how much time you expect to be out - discuss a next moment of contact (phone appointment or presence in the office) Any data regarding the illness itself is off-limits for the employer, you are allowed to volunteer the information but the employer strictly isn't even allowed to ask.
- mytailorisrich 6y ago
  I am writing from Europe. I am not suggesting that an employer has access to employees' medical records. However, the fact is that employers will reasonably keep track of sicks leave and will in practice (and quite reasonably) have knowledge of health information very often including the illness. Personally, I think things start to go too far. Saying that "employee health is a personal matter" is going too far. Intimate details are of course personal and people may not want to share too much (and that's fine) but an employee's health insofar it impacts their job very much concerns the employer, but it must be handled lawfully, reasonably, and tactfully by them. If the employer has a clear picture it is not necessarily negative for the employee as it means that the employer can adapt and take the appropriate supportive action. I think that the legislator recognises this, seeing that employment is an exception to the GDPR's ban on health information processing (obviously without reason).