5 ms·
H&M Hit with Record-Breaking GDPR Fine over Illegal Employee Surveillance
- obilgic 6y ago$41.3 million? record-breaking maybe, but won't make a dent
- thomasahle 6y agoEither they change it, or they just get a bigger fine in a year or so. Germany is really the world leader in personal liberty / privacy.
- kingkawn 6y agoWhich may explain how their booming neo-nazi terrorist movement has grown so undisturbed
- stevehawk 6y agoso privacy == bad because it encourages racism?
- untog 6y agoI don’t think OP’s post was in good faith but I actually do think this is an interesting discussion! A lot of conspiracy theory and white supremacism thrives in places like private WhatsApp groups. I don’t think that means we have to remove all privacy but it is interesting to consider the trade offs involved.
- sokoloff 6y agoAs abhorrent as I find white supremacy groups, I don’t see any real trade off that I’m willing to make to reduce even a tiny amount of the privacy and security of communications to give government better power or means to police these groups. I find private communications so sacrosanct that I’m willing to allow even the most vile form of private communications to remain private rather than sacrifice the privacy of all to aid government in policing the outliers.
- kingkawn 6y agoAbsolutism is a common sight seeing stop off on the road to regret
- alistairSH 6y agosokoloff is right. This is why warrants exist. If those private conversations turn towards criminal action, then the government can take action. Until then, there is nothing to act upon - speech is "free".
- dmurray 6y agoI think sokoloff is going further than you: he thinks private conversations should be "sacrosanct", you seem to think they should be intercepted by anyone who suspects they "turn towards criminal action" and can reach the low bar of obtaining a warrant.
- alistairSH 6y agoThat bar is currently too low (FISA and all the other post-9/11 nonsense), IMO, but generally, yes.
- JoeAltmaier 6y agoA tradeoff that needs supporting. How dangerous are the outliers? How have societies fared, that took this trade? Is the absolutism justified ("sacrifice the privacy of all")?
- kingkawn 6y agoIn this case the german trauma from the stasi led to a privacy state that has allowed an inhumane terrorist political movement to grow unchecked within the security services and society in general. You and others here are downvoting and acting shocked shocked shocked but if a democratic society cannot prevent the rise of anti-democratic internal threats due to blind adherence to its abstract ideals then it is not long for this world.
- sokoloff 6y agoThe communications are not the problem (IMO). It might be a convenience for government actors if laws and technology allowed the government to monitor everything, but it’s only the deeds that harm us. I try to think not only of what good my like-minded government might do with these expanded powers but also what ill my opposite-minded government could do with these powers.
- blablabla123 6y ago> german trauma from the stasi As bad as the stasi was, what happened during the holocaust was far worse and stasi affected much less people. It's therefore far-fetched to explain focus on privacy with that. Also as bad as the Neo Nazi Terror is in germany, it's actually worse in some other countries. In the US nazi militias continually existed throughout the 20th century. You rarely see it in the news because nobody seems to care and the organizations are not only legal but even get support from the US president. Please also consider acts of Nazi Terror that happened in NZ and Scandinavia. Moreover right wing conservative movements like AfD are also much stronger in other countries, e.g. RN in France, PVV in NL or Fidesz in Hungary.
- morceauxdebois 6y agoWell there's not gonna be much privacy if authoritarians take over
- swarnie_ 6y ago> Germany is really the world leader in personal liberty / privacy. > "After absences such as vacations and sick leave the supervising team leaders conducted so-called Welcome Back Talks with their employees. After these talks, in many cases not only the employees' concrete vacation experiences were recorded, but also symptoms of illness and diagnoses,” Are you sure? That sounds very Americanesk dystopian to me.
- tannhaeuser 6y agoNow I'm confused both by the GP's comment and yours. H&M is a Swedish company isn't it? And the fine is indeed a slap on the wrist relative to their revenue.
- solarkraft 6y agoThis is why they were fined.
- GordonS 6y agoHopefully the bad publicity over this will also help to force them to change their behaviours.
- tgsovlerkhgsel 6y agoPrevious discussion: https://news.ycombinator.com/item?id=24650634 https://news.ycombinator.com/item?id=24650634
- mabbo 6y ago> parts of the workforce had been subject to "extensive recording of details about their private lives". > "After absences such as vacations and sick leave the supervising team leaders conducted so-called Welcome Back Talks with their employees. After these talks, in many cases not only the employees' concrete vacation experiences were recorded, but also symptoms of illness and diagnoses,” I'm trying to come up with any legal, ethical reason to want to have and keep records on this. Every manager collecting these records has to somehow justify to themselves that this is okay, and I can't fathom how.
- save_ferris 6y agoIt would be pretty easy for them to convince themselves that collecting this data would be helpful for loss-prevention, keeping quotas up, whatever. It doesn’t even have to be true. Many employers take advantage of the power they have over employees. The real outrage to me is how this is definitely happening in the US and we have no way to combat it.
- whimsicalism 6y agoI mean even labor laws on the book are hardly enforced in the United States.
- NikolaeVarius 6y agoPlease present evidence of this assertion.
- sevencolors 6y agoHave you ever had a non-office job? Literally everyone that’s worked in any service or retail industry can tell you horror stories. Supervisors routinely break labor laws and abuse their position in the name of “getting shit done”. Most of it is so minor it’s not worth risking your job to complain. And when something big happens and you say something to higher ups you get brushed off. If you’re lucky your boss might pay attention and then eventually the jerk breaking the laws gets fired.
- mrkwse 6y agoWorth noting that while it's the largest fine from the German regulator, it's only the fourth highest across Europe. The UK's ICO have issued fines of ~€205m and ~€110m to British Airways and Marriott Intl. respectively, while France's CNIL have fined Google €50m. H&M were only fined ~€35m.
- eeZah7Ux 6y ago"record-breaking" and it's not even a slap on the wrist.
- nairboon 6y agoA record-breaking 0.3% of their 2019 gross profit.
- tomalpha 6y agoI can imagine they have tight margins. This might be more painful than an apparently small percentage might appear.
- black_puppydog 6y agoTheir profit was $1.5B last year. $41M is less than 3% of that. Not nothing, for sure. But the GDPR allows for up to what, 4% of revenue? Their revenue was $24.3B. That would have been $970M in fines then. H&M got a slap on the wrist. Just like all the other companies before them.
- humanlion87 6y agoTo me it seems like a strong warning since it's a "first time offense". Not too high so as to break the company (and say push it to exit the German market). But significant enough to make sure they don't do it again. My guess is repeat offenders will get higher fines.
- a_imho 6y agoNah, for example Google/Alphabet is a continuous offender ever since GDPR become enforceable and was already fined 3 times according to https://www.enforcementtracker.com/ https://www.enforcementtracker.com/
- foepys 6y agoGDPR is not supposed to kill companies but to make the respect the law and this fine is a warning shot. If H&M ignores GDPR again, the fine will be significantly higher.
- a_imho 6y ago
- jpgvm 6y agoI take issue with their response, quoted below: > A comprehensive action plan has been launched to improve the internal auditing practices to ensure data privacy compliance, strengthen leadership knowledge to assure a safe and compliant work environment, and continue to train and educate both staff and leaders in this area How is the response to this incident to try prevent further breaches rather than vowing to not collect this data in the first place? Why is this an acceptable response at all?
- tortasaur 6y agoI don't read this as saying they'll prevent further breaches. It seems to be saying that they will improve compliance with data privacy regulation.
- jameshart 6y agoRight, collecting the data in the first place was a compliance breach. We're so used to the only kind of data protection enforcement being for data leakage - but this is actually a great example of what GDPR is really for: putting a framework around what personal data it's acceptable for companies to process in the first place.
- colejohnson66 6y agoTo expand: it’s not necessarily the collection that’s bad, but that leaks will happen. It’s not a matter of if, but when. So by putting limits on what can be collected, it mitigates some of the damage of a leak.
- jameshart 6y agoNo, it really is that collecting the data is bad! GDPR is not about making breaches less harmful (though that is a benefit) - it is about preventing businesses from secretly gathering data about you, without your knowledge, and using it in ways that harm you. One of the ways in which a business can harm you through abusing the data they have about you is certainly allowing it to leak out - but that is very much not the only intention of data protection law.