The CNIL issues ten new sanctions under its simplified procedure
Geolocation of company vehicles and employee video surveillance, data minimization, right to object: in response to the many complaints received on these subjects, the CNIL has issued ten new decisions under its simplified sanction procedure.
Over the past two months, the CNIL has issued ten new decisions under its new simplified sanction procedure, introduced in 2022.
Private and public-sector players were fined a total amount of 97,000 euros because they didn't respect:
- the obligation to respond to CNIL requests;
- data minimization (geolocation and continuous video surveillance of employees);
- information on the processing carried out and its purposes;
- the obligation to respect the rights of individuals, and in particular to respond to a request for objection.
Created in 2022, the simplified procedure concerns cases that do not present any particular difficulty, and for which a fine of up to 20,000 euros may be imposed.
It enables the CNIL to increase the effectiveness of its repressive action in response to the complaints received, which increase every year. More than 12,000 complaints in 2022, i.e. +72% since the GDPR came into force in 2018.
In cases where infringements require more severe penalties, decisions are taken under the ordinary procedure.
Focus on employee geolocation and video surveillance
In these ten decisions, two issues were in particular brought out: geolocation of employee vehicles and employee video surveillance.
On the first issue, the CNIL pointed out that the continuous recording of geolocation data, with no possibility for employees to stop or suspend the system during break times, is, unless there is special justification, an excessive infringement of employees' freedom to come and go and right to privacy.
With regard to the second issue, it reaffirmed its position on the deployment of video surveillance systems which, for no particular reason, constantly film employees at their workstations. Indeed, the prevention of accidents in the workplace and the gathering of evidence do not justify the implementation of continuous video surveillance of workstations. Under these conditions, the personal data generated by the video surveillance system is neither appropriate nor relevant. The permanent surveillance of employees is, with a few exceptions, disproportionate to the aims pursued.
As part of a dissuasive and proportionate repressive policy, and within tighter deadlines, CNIL will regularly issue sanctions under the simplified procedure, and report on them on its website.