The French data protection authority (CNIL) fined Amazon France Logistique €32 million for deploying surveillance tools to monitor employee activity in its warehouses without properly informing workers or justifying the extent of the data collection. The decision highlights how failing to meet transparency obligations under the GDPR, particularly in workplace settings, can have serious financial and reputational consequences.
What happened?
Amazon France Logistique was found to have implemented extensive monitoring systems within its warehouses, including handheld scanners that tracked worker productivity in real-time.
These scanners recorded the pace at which employees completed tasks, generating alerts when they were deemed to be “inactive” or making “errors”.
CNIL’s investigation revealed that employees were not adequately informed about the nature and purpose of the data being collected, nor were they provided with appropriate privacy notices.
The systems had been in operation for several years without a data protection impact assessment (DPIA), which is mandatory under Article 35 of the GDPR when processing is likely to result in high risks to rights and freedoms.
CNIL concluded that the processing was excessive, disproportionate, and lacked transparency, resulting in a €32 million fine.
Why was this a problem?
Article 5(1)(a) of the GDPR requires that personal data be processed lawfully, fairly, and in a transparent manner. Amazon failed to inform its workers adequately and did not justify the legal basis for the level of surveillance deployed.
The absence of a DPIA meant Amazon had not formally assessed the risks posed by this high-intensity monitoring, despite the potential impact on employee dignity and privacy.
The system effectively created constant behavioural surveillance in a work environment, which CNIL deemed excessive in light of the principles of data minimisation and proportionality.
This lack of transparency and proportionality constituted multiple breaches of the GDPR, particularly Articles 5, 12, 13, and 35.
What does it mean for your organisation?
This case highlights the need for transparency in any workplace monitoring activity. Efficiency alone is not enough to justify invasive data processing, particularly when it may create pressure or stress among staff. Transparency isn’t just a compliance checkbox, it requires clear, consistent communication with those affected.
To stay compliant:
Be transparent about monitoring: Clearly inform employees about what data is collected, why, and how long it is retained.
Conduct DPIAs where required: For any processing likely to result in high risks, such as workplace surveillance, a DPIA is essential.
Respect data minimisation: Only collect data that is strictly necessary for the stated purposes, and avoid excessive tracking.
Engage staff in privacy dialogue: Promote a culture where data protection is not only a legal duty but part of ethical business practices.
The takeaway?
Monitoring in the workplace is a sensitive area under data protection law. Organisations must strike the right balance between legitimate interests and employee rights. Transparency is not optional, and when it’s missing, the penalties can be substantial.
Tales from the coalface
Each month, we examine Data Protection issues encountered by our clients. This month, we turn our attention to a compliance issue that continues to trip up even well-intentioned organisations: cookies and other tracking technologies. While the topic may seem technical, the legal risks are real, and regulators across Europe are increasingly scrutinising how websites handle user consent.
Cookies: Small Files, Big Risk
Cookies and similar technologies (like pixels and local storage) are embedded across websites and apps to personalise content, enable analytics, and power targeted advertising. But under the ePrivacy Directive and the GDPR, any non-essential cookies require valid, informed, and freely given user consent before they are set.
Yet, what we still see across many websites is a worrying mix of misconfigured banners, pre-ticked boxes, vague language, and cookies dropping without any consent at all. The problem is often exacerbated by third-party scripts embedded via marketing or analytics tools, which bypass local controls.
What’s the risk of non-compliant cookie use?
Unlawful processing of personal data: If personal data is collected via cookies without valid consent, the processing lacks a lawful basis under Article 6 GDPR.
Breach of the ePrivacy regime: consent for storing or accessing information on a device is required prior to accessing. Failure to obtain that consent is a standalone violation, even before GDPR is considered.
Enforcement action: Regulators across the EU, including CNIL (France), AEPD (Spain), and the Autoriteit Persoonsgegevens (Netherlands), have issued fines and orders in recent years specifically for unlawful cookie practices.
User complaints and reputational harm: Increasingly, individuals are aware of their rights and willing to complain when they feel their choices are ignored or manipulated.
Loss of control: When third-party scripts operate unchecked, your organisation may not even know what data is being collected or where it’s going, creating major accountability gaps.
Why it happens:
Cookie compliance is often viewed as a “set and forget” exercise, when in reality it requires ongoing management and close coordination between legal, marketing, and IT teams. Common issues include:
Consent banners deployed without legal review or proper testing.
Marketing tools are added to websites without any risk assessments.
Cookie scans are outdated or incomplete.
Consent logs are not retained, making it impossible to demonstrate compliance.
Users are nudged towards accepting cookies through misleading design or lack of granularity.
How to fix it:
Building a compliant cookie framework involves more than just a banner. It means embedding privacy by design into your web architecture and being transparent and accountable at every step.
Implement a compliant cookie management platform: Use a tool that blocks non-essential cookies by default and enables granular user choices.
Keep your cookie audit up to date: Regularly scan your site to identify new trackers and ensure they are properly categorised.
Customise your banner and policy: Avoid generic language. Clearly explain what each category of cookie does and who sets it.
Store and manage consent records: You must be able to demonstrate that consent was obtained and respected.
Test across user journeys: Check what happens when a user declines consent. No cookie should be dropped unless it's strictly necessary.
Cookie compliance isn’t just a checkbox, it’s a reflection of how seriously your organisation takes transparency and user choice. When cookie practices are poor, they often point to broader gaps in governance. Getting it right shows users and regulators that data protection is being taken seriously.
If your organisation hasn’t reviewed its cookie set-up in the last 6–12 months, or if your site has grown significantly, it may be time for a full audit and refresh. If your organisation needs support reviewing cookie practices, updating consent mechanisms, or conducting a full website audit, Ambit Compliance can help.
Contributors to this blog:
Gillian Traynor, Facundo Marcos Heredia and Dwayne Morgan
