La Samaritaine hid miced cameras as smoke detectors to watch staff — CNIL fined it €100K

La Samaritaine, the LVMH-owned department store at the Pont Neuf that reopened in 2021 after a 16-year makeover, faced rising merchandise theft in August 2023. Management's answer was covert: new cameras in two stockrooms disguised as smoke detectors, fitted with microphones that recorded employee conversations. Staff discovered the devices a few weeks later and they were removed in September 2023. A Mediapart investigation that November alerted the CNIL; complaints followed, and the regulator inspected within days.

In September 2025 the CNIL's restricted committee fined SAMARITAINE SAS €100,000 for three GDPR failures. Loyalty and accountability: hidden cameras are tolerated only in exceptional circumstances backed by a documented proportionality analysis, and the store ran none — the devices appeared in neither its processing register nor its impact assessment. Minimisation: recording private conversations was excessive by any theft-prevention logic. DPO involvement: the data protection officer only learned of the installation weeks later, though she could have flagged risk-limiting measures in time.

The regulator accepted that the thefts were real and the device temporary — the fine was for everything missing around it. The European Court of Human Rights case law the CNIL cited allows covert monitoring only when it is strictly necessary, time-limited and justified in writing before deployment. Samaritaine's security response skipped every step that would have made it lawful, and an undocumented device left the company with no defense once staff pulled the fake smoke detectors off the ceiling.

€100,000 CNIL fine; concealed smoke-detector cameras with microphones captured private staff conversations before employees found them

Security urgency substituted for compliance: theft pressure made concealment feel justified, but no GDPR analysis, register entry or impact assessment accompanied the deployment.

The microphones exceeded any theft-prevention need — recording private conversations between staff breached data minimisation outright.

The DPO was bypassed: informed only weeks after installation, she lost the chance to shape a proportionate device before employees found it.

Documentation could not be retrofitted: an undocumented 'temporary' installation left nothing to prove proportionality when the regulator asked.

Anti-theft urgency breeds surveillance overreach. Hidden cameras are defensible only as a documented, temporary last resort — the DPO consulted before deployment, not after staff find them.

The cameras came down in September 2023, before regulators knew they existed. The CNIL adopted decision SAN-2025-008 on 18 September 2025 and published it a few days later with the €100,000 fine, using the case to remind employers that covert monitoring survives only inside the European Court of Human Rights' narrow exception: exceptional circumstances, strict temporariness and a documented balance between property protection and staff privacy.