H&M logged staff's diagnoses and religious beliefs after every absence — fined €35.3M

Since at least 2014, managers at H&M's service center in Nuremberg, Germany held informal "Welcome Back Talks" with employees returning from any absence — vacation, sick leave, or otherwise — and recorded far more than the conversation required. Notes captured employees' illness symptoms and diagnoses, family conflicts, religious beliefs and other private details having nothing to do with work performance, and the files were accessible to as many as 50 managers across the company.

The practice ran for years without discovery until October 2019, when a configuration error exposed the entire contents of the shared network drive company-wide for several hours. Employees who saw files about colleagues alerted the works council, and press reports followed, which brought the matter to the Hamburg data protection authority.

Investigators seized and reviewed roughly 60 gigabytes of records covering several hundred employees. In October 2020 the Hamburg Commissioner fined H&M €35,258,707.95 — at the time the largest GDPR fine issued by a German authority — for systematically collecting and retaining sensitive personal data about staff with no legal basis and no need tied to any business purpose.