Between 2013 and 2017, the CNIL received complaints from several employees of Uniontrad Company (a very small company with nine employees, specialised in translation) who were filmed at their workstations. On two occasions, the CNIL alerted the company regarding the rules to be observed when installing cameras at the workplace, in particular that employees must not be filmed continuously and that information on the existence of the cameras should be provided to them.
In February 2018, the CNIL carried out an audit at the company’s premises. It found that:
In July 2018, the CNIL issued a formal notice asking the company to comply with the French Data Protection Act, specifically by:
In the absence of satisfactory measures having been put in place at the end of the deadline set in the formal notice, the CNIL carried out a second audit in October 2018, which confirmed that the breaches continued despite the company’s assertions to the contrary.
Consequently, the CNIL imposed an administrative fine of EUR 20,000, considering that the breaches noted by the auditors persisted. In particular, the CNIL took into consideration the size and financial situation of the company, which showed a negative net result for 2017, in deciding to adopt a dissuasive but proportionate administrative fine.
It also ordered the company to ensure it implemented traceability of access to the shared professional messaging system and to provide evidence of it within two months from the notification of its decision. At the end of this period, a penalty payment of EUR 200 per day of delay (dating from the date of the CNIL’s notification) will be imposed if the company has still not complied.
In making its decision public (i.e. available on official websites), the CNIL has provided a reminder of the sensitivities around using video surveillance to monitor the employees in the workplace. It also highlights the importance of responding to the CNIL’s formal notices. It was the company’s stated refusal to take the measures to comply, despite benefiting from the CNIL’s support towards achieving compliance with the instructions it had received that justified the initiation of sanction proceedings in this case.