Article updated with Amazon’s response to CNIL ruling on 29 January 2024.
The French National Commission on Informatics and Freedom (CNIL) has imposed a substantial fine of €32 million on Amazon France Logistique, a subsidiary that manages Amazon’s extensive warehouses in France. The fine, issued on 27 December 2023, stems from the company’s implementation of an intrusive employee monitoring system, which violates privacy regulations and breaches GDPR standards.
Amazon France Logistique’s monitoring system involved equipping warehouse workers with scanners to document the real-time performance of tasks such as stocking, picking, packing and other activities. Each scan generated data that was used to calculate indicators that provided insight into the quality, productivity and inactivity of individual workers.
The CNIL initiated inspections and received complaints from employees following press articles highlighting questionable practices in Amazon’s warehouses. The Commission found the monitoring system to be overly intrusive and raised specific concerns.
Firstly, the CNIL considered Amazon’s measurement of inactivity to be unlawful, as the company’s system included indicators that measured the exact inactivity time of employees’ scanners, leading to potential control and justification of any break or interruption.
Secondly, the CNIL considered the measurement of scanner speed during item storage to be excessive, in particular the implementation of an indicator that flagged items scanned too quickly (in less than 1.25 seconds after the previous one).
Thirdly, the French authority considered it excessive to store all data and statistical indicators collected by the system for 31 days for all employees and temporary workers.
The CNIL recognised the need for monitoring in Amazon’s high performance environment, but considered the extensive data retention and resulting statistical indicators to be disproportionate.
As a result, the French data protection authority fined Amazon France Logistique 32 million euros. The fine was set in view of the scale and permanence of the monitoring system, which affected thousands of employees and potentially contributed to Amazon’s economic gains and competitive advantage in the online sales sector.
The breaches identified by the CNIL include shortcomings in relation to the monitoring of employees’ activities using scanners, data minimisation principles, lawfulness of processing, and breaches in relation to work planning and employee evaluation. In addition, the company faced GDPR breaches related to the obligation to provide information and transparency regarding the processing of video surveillance.
In response to the fine, Amazon France Logistique must address the issues identified and adjust its monitoring practices to comply with GDPR and privacy regulations.
Amazon’s press office has contacted Trans.iNFO to comment on the CNIL decision:
“We strongly disagree with the CNIL’s conclusions which are factually incorrect and we reserve the right to file an appeal. Warehouse management systems are industry standard and are necessary for ensuring the safety, quality, and efficiency of operations and to track the storage of inventory and processing of packages on time and in line with customer expectations.”