{"id":6762,"date":"2020-10-07T12:19:44","date_gmt":"2020-10-07T12:19:44","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=6762"},"modified":"2022-07-15T14:26:08","modified_gmt":"2022-07-15T14:26:08","slug":"data-protection-alert-cost-hm-e35m","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/data-protection-alert-cost-hm-e35m\/","title":{"rendered":"Data protection alert: A not quite \u2018legitimate interest\u2019 just cost H&#038;M \u20ac35m!"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"6762\" class=\"elementor elementor-6762\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The GDPR gives powers to local data protection authorities to fine organisations who breach the data protection and processing regulations. This month, H&amp;M Germany was fined over \u20ac35m by the Hamburg Data Protection Authority (HmbBfDI) in Germany, for a data protection breach that revealed the <\/span><a href=\"https:\/\/www.infosecurity-magazine.com\/news\/hm-fined-352m-for-gdpr-violations\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">excessive use of employee data<\/span><\/a><span style=\"font-weight: 400;\">. That adds up to a lot of great value clothing items.&nbsp;<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">GDPR compliance: Where H&amp;M flouted data protection rules<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">First up, we should note that this incident was in an H&amp;M Service Centre in Nuremberg, and H&amp;M have been quick to say that it is not a company-wide policy. H&amp;M have also stepped in to offer compensation to every employee who worked at the service centre for more than a month since May 2018, bringing the cost of this episode way over \u20ac35m.&nbsp;<\/span><\/p>\n<p style=\"font-weight: 400;\">\n<\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">In October 2019, an error on an internal computer drive made its contents visible to every employee at the Nuremberg Service Centre. This data protection breach showed files and files of personal data for every employee. The data breach was one thing, but the nature of the data itself is also a problem.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The files showed that between 2014 and 2019, managers recorded data about employees and filed it on a drive accessible to other managers at the site. This data was then used to create detailed profiles of the employees and make decisions about their employment.&nbsp;<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The personal data in these files was obtained from one-to-one conversations between employees and their managers or team leaders usually at a return to work interview following a long illness, or a weekly meeting, but also including chats at the water cooler. The information recorded included holiday experiences, religious observances, family issues, illness and more.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Understanding GDPR compliance for data processing<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Perhaps unsurprisingly, the HmbBfDI ruled that this collection of details and record of activities encroached on employees\u2019 civil rights. This put them in contravention of the laws about data privacy and processing.<\/span><\/p>\n<p style=\"font-weight: 400;\"><a href=\"https:\/\/gdpr.eu\/article-6-how-to-process-personal-data-legally\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Article 6 of the GDPR<\/span><\/a><span style=\"font-weight: 400;\"> states that any processing of personal data should be lawful and fair. Individuals (in this case the employees) should know what data is collected, used, consulted, or processed and to what extent it will be processed. The specific purposes that this data will be processed for should be made clear at the time of collection.<\/span><\/p>\n<p style=\"font-weight: 400;\"><a href=\"https:\/\/gdpr.eu\/recital-39-principles-of-data-processing\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Recital 39<\/span><\/a><span style=\"font-weight: 400;\"> further states that the personal data collected should also be adequate, relevant and limited to what is necessary for the specific purpose for which they are processed. Personal data should only be processed if there is no other way to fulfill the purpose it is processed for.<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Personal data should also be processed in a way that ensures appropriate security and confidentiality, including preventing unauthorised access to the data itself.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Data protection compliance is not optional<\/span><\/h2>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Breaching data protection regulations could have major implications for your organisation\u2019s finances. Failure to comply with the GDPR can lead to fines of up to 4% of worldwide annual revenue. Note we say revenue, not profit, so if your profit margins are tight, that chunk of money can leave a serious hole in your finances. Fines may not have reached 4% of revenue yet, but they have been serious amounts of money.&nbsp;<\/span><\/p>\n<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">According to the GDPR, employee data protection is just as important for every organisation as user data protection. And just like with user data protection, it is important to have the policies and processes in place to secure employee privacy. On the plus side, it will cost less than a potential fine.<\/span><\/p>\n<p style=\"font-weight: 400;\">Get your data protection programme in place, and make sure your organisation is <a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/privacy-data-protection-gdpr\/\">GDPR compliant<\/a> now.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>H&#038;M are the latest organisation to receive a fine for data protection failings &#8211; this time though it was their own employee data that they failed to protect<\/p>\n","protected":false},"author":10,"featured_media":8091,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/6762"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=6762"}],"version-history":[{"count":1,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/6762\/revisions"}],"predecessor-version":[{"id":8092,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/6762\/revisions\/8092"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/8091"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=6762"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=6762"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=6762"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}