On 27 December 2023, France’s Data Protection Authority (hereafter DPA), the CNIL, issued a sanction of €32 million against Amazon France Logistique (AFL), a French affiliate of Amazon EU based in Luxembourg, for disproportionate and intrusive employee monitoring practices in breach of the GDPR(1).

AFL’s activity is to manage the Amazon Group’s large warehouses in France where items from suppliers are received, stored and then prepared for shipment to Amazon customers. To perform these tasks AFL’s employees are equipped with scanners which identify the employee, and which are to be used to scan product tags or locations where they are to be placed or taken from. The scans made by employees not only allow AFL to follow the progress of any item through the various stages of the preparation process but also enable it to measure its employee’s performance and overall activity using various indicators (quality and errors, productivity, and work interruptions) collected in real time. On such a basis, managers may monitor each employee on the timing of each scan, the latest mistakes made, the number of items handled per hour, and the duration of interruption of work. This information can be presented as raw data or in the form of statistics.