| On 27 December 2023, the French Data Protection Authority (CNIL) imposed a fine of €32 million on AMAZON FRANCE LOGISTIQUE. The main reason for the fine was that Amazon had set up an excessively intrusive system for monitoring the activities and performance of its employees. Each warehouse worker was given a scanner to document in real time the performance of certain tasks assigned to them (e.g. storing, un-shelving, stowing, loading, etc.). The system also stored information on the quality of the work, productivity and periods of inactivity of the employees, based on the documentation of the tasks performed by the employees. Although the Authority did not question that the high performance targets set by the company could justify the scanner system put in place to manage its business, it considered that the retention of this data and the resulting statistical indicators was disproportionate overall. Disproportionality existed both in terms of the retention time and the amount of data measured. The main aspects taken into account by the French authorities in imposing the penalty were that the processing of employee data by scanners differed from traditional methods of activity monitoring because of the scale of implementation and led to very close and detailed monitoring of employees’ work, which put them under constant pressure. In addition, the large number of people involved (thousands of people) and the fact that the constraints imposed on employees through computerised monitoring contributed directly to the company’s economic profits and gave it a competitive advantage over other companies in the online sales market were important considerations. The excessive rate was found by the Authority because the device also included indicators tracking the inactivity time of employees’ scanners, potentially making employees feel that they had to justify any break or interruption. The authority also found the system for measuring the speed of scanning goods, which documented whether an item was scanned in less than 1.25 seconds after the previous one (this was considered too fast, at which point the scanner would indicate an error), excessive. In addition, the authority considered it excessive that the system retained all data collected by the system, and the resulting statistical indicators for all employees and temporary workers, for 31 days. Another factor contributing to the fine was the data security weaknesses identified by the Authority in the CCTV surveillance: the password used was weak and shared between several users, making it impossible to track which user had access to the recorded images and when. |