French real estate company fined for disproportionately monitoring its employees

The Commission Nationale de l’Informatique et des Libertés (CNIL) has imposed a fine of €40,000 on a French real estate company for excessively supervising its employees.

The company in this matter had installed monitoring software on some of its home working employees’ computers for measuring their productivity and evaluating their performance.

According to the French data protection authority (DPA), the software automatically detected when a worker hadn’t touched his mouse or keyboard for the duration of three to fifteen minutes. If he couldn’t justify his ‘inactivity’, he was subjected to a deduction on his salary.

However, the CNIL argues that not using a computer doesn’t necessarily mean an employee isn’t working. For example, he could be handling a work-related phone call or conference meeting. Therefore, the software doesn’t reliably measure someone’s productivity.

In addition, the software disproportionately monitored the company’s employees, which is an infringement of their legal rights. Therefore, these surveillance practices are not based on any legal basis.

Furthermore, the software provided insight into what websites employees working from home visited during working hours. These sites were divided in two categories: productive and non-productive. It was also determined how much time employees spent on these sites.

To add insult to injury, the company had set the software to take a screenshot every three to fifteen minutes. This way the employer could see what’s on the screen of his employees and judge whether they were working or not. However, personal data could have also been leaked, the supervisor states.

Lastly, the company had installed two cameras that continuously recorded images and sound of employees present on the work floor and break room. Managers could view and search the images in real time via an app.

According to the French supervisor, the company could not justify the exceptional circumstances to continuously record sound and images. Such actions are a violation of the rights of employees and are therefore contrary to the principle of data minimization.

All in all, the CNIL speaks of an excessive infringement of the rights of employees. The supervisor concludes that the company has violated the General Data Protection regulation (GDPR) in several ways and therefore ultimately imposed a fine of €40,000.