• Insights

France – EUR 20,000 penalty imposed for an excessive video monitoring of employees

France
23.07.19
2
Written by
Capstan Avocats, the law firm setting the benchmark for labour law in France.
The French data protection authority, the CNIL, has imposed a penalty of EUR 20,000 on a company that implemented a video surveillance system that placed its employees under constant monitoring. 

Between 2013 and 2017, the CNIL received complaints from several employees of Uniontrad Company (a very small company with nine employees, specialised in translation) who were filmed at their workstations. On two occasions, the CNIL alerted the company regarding the rules to be observed when installing cameras at the workplace, in particular that employees must not be filmed continuously and that information on the existence of the cameras should be provided to them.

In February 2018, the CNIL carried out an audit at the company’s premises. It found that:

  • The camera present in the office of the six employees filmed them at their workstations without interruption.
  • Insufficient information had been provided to employees concerning the existence of the cameras.
  • The computer workstations were not secured by a password and the translators accessed a shared professional messaging system with a unique password.

 

In July 2018, the CNIL issued a formal notice asking the company to comply with the French Data Protection Act, specifically by:

  • Moving the camera so that employees were no longer filmed constantly.
  • Informing the employees of the existence of the cameras.
  • Implementing security measures for access to computer workstations and for ensure the traceability of access to professional messaging (the implementation of an access traceability measure makes it possible to create a history of access and actions performed by people who connect to the mailbox and thus ensure the security of personal data).

 

In the absence of satisfactory measures having been put in place at the end of the deadline set in the formal notice, the CNIL carried out a second audit in October 2018, which confirmed that the breaches continued despite the company’s assertions to the contrary.

Consequently, the CNIL imposed an administrative fine of EUR 20,000, considering that the breaches noted by the auditors persisted. In particular, the CNIL took into consideration the size and financial situation of the company, which showed a negative net result for 2017, in deciding to adopt a dissuasive but proportionate administrative fine.

It also ordered the company to ensure it implemented traceability of access to the shared professional messaging system and to provide evidence of it within two months from the notification of its decision. At the end of this period, a penalty payment of EUR 200 per day of delay (dating from the date of the CNIL’s notification) will be imposed if the company has still not complied.

In making its decision public (i.e. available on official websites), the CNIL has provided a reminder of the sensitivities around using video surveillance to monitor the employees in the workplace. It also highlights the importance of responding to the CNIL’s formal notices. It was the company’s stated refusal to take the measures to comply, despite benefiting from the CNIL’s support towards achieving compliance with the instructions it had received that justified the initiation of sanction proceedings in this case.

Authors
Basile
Basile Moore
Lawyer - France
Capstan Avocats