German laptop retailer fined $12.7M under GDPR for employee surveillance
complianceweek.com
complianceweek.com
> However, in order to prevent theft, a company must first use “milder” methods, such as random bag checks when employees leave the premises. Moreover, the LfD said video surveillance is only lawful if there is “justified suspicion” against specific persons, and even then, video monitoring may only be used for a “limited” time.
> The data authority found NBB’s video surveillance was neither limited to a specific period of time nor to specific employees. The recordings were saved for 60 days in many cases. Customers were also filmed in seating areas without their knowledge or consent.
> The regulator said “the allegedly deterrent effect of video surveillance, which is repeatedly put forward, does not justify a permanent and unprovoked interference with the personal rights of employees” in a translated press release.
> “We are dealing with a serious case of video surveillance in the company,” said Barbara Thiel, head of LfD Lower Saxony, in a translated statement. “Companies must understand that with such intensive video surveillance they are massively violating the rights of their employees.”
> Thiel added video surveillance is “a particularly intensive encroachment on personal rights” because it can pressurize employees “to behave as inconspicuously as possible in order not to be criticized or sanctioned for deviating behavior.”
Finally! It always amazes me how computer monitoring and video surveillance at the workplace have become so widespread.
Also, the idea of focussing on widespread breaches of the right to privacy is a great one. It helps spread a better understanding of the meaning of the right to privacy.
This isn't exactly a new legal situation in Germany at least. (Which obviously doesn't mean companies don't try, otherwise we wouldn't have headlines like this...)
If someone wanted to leave the GDR, were they able to?
If not, why do you think they weren't able to? Why do you think people wanted to leave, and why do you think people wanted to stop them? Why do you think they had to literally shoot people to stop them leaving the country if it wasn't a dictatorship and they were welcome on the other side?
Are you confused about the 'Democratic' part of the name? North Korea also calls itself 'Democratic' today.
Read some history:
https://en.wikipedia.org/wiki/Politics_of_East_Germany
> Elections were held but were effectively controlled by the SED and state hierarchy, as noted by Hans Modrow [communist premier of East Germany] and others.
The last premier of East Germany was literally convicted of electoral fraud after unification.
> Modrow did not deny the charges, but argued that the trial was politically motivated and that the court lacked jurisdiction for crimes committed in East Germany
It was a dictatorship. Any reasonable historian or even person there at the time will tell you this. The literal Premier himself didn't even deny it.
Why do you think that has anything to do with whether it is a dictatorship?
Not having free elections makes it a dictatorship (or at least not a democracy). Not allowing people to leave makes it a shitty place to live, but that is separate from if its a dictatorship.
How else do you explain people willing to die to leave and why do you think the party tried to stop them?
> Not having free elections makes it a dictatorship (or at least not a democracy).
That’s how it was! The leader of the dictating party does not deny this is how it was! You’re delusional!
There is a good sign that your free elections aren't when you have 99% percent approval rating on every election. A sharp drop in approval ratings once you no longer control the elections directly may also be indicative of problems with your implementation of democracy.
I don't think this is just a pedantic point. It's good to push back against the labelling of "everything you don't like" with the most convenient wrongthink labels: see the trend towards labeling $BAD_THINGS as communism, terrorism, or more fashionably these days, fascism.
While some folks think a dictatorship requires a single person or small group in charge, it is widespread opinion in Germany, that the GDR was is in fact seen as a "dicatorship by one party", the SED. Mostly (to my understanding) this is based on the lack of separation of powers found in the GDR.
The "dictatorship" question is regulary a topic of more or less philosophical but most certainly emotional debates with each side being sure they are right. I cannot tell the percentage of "dictatorship"/"non-dicatorship" proponents.
(I am no history nerd.)
edit: pls replace "that the GDR was is in fact seen" with "that the GDR is in fact seen" in your mind
The GDR was a dictatorship good and proper. They just avoided giving the impression of having a single leader by speaking through the politbureau. And the local dictators were controlled by the ones in Moscow.
https://de.wikipedia.org/wiki/Diktatur_des_Proletariats
But jokes aside: if a very small elite clings to power and doesn't allow free elections, doesn't let people live in freedom, even kills them if they try to leave, and eventually is overturned by the people, these are all signs of a "lupenreine" dictatorship, no?
How does it reconcile with it taking nearly 17 years for Germany to outlaw BND from wiretapping DE-CIX?
And while one of the lessons of Nazi Germany is keeping the secret services on a tight leash, that leash has become longer and longer during the cold war. Nowadays, I do not think there is any effective control of Germany's secret services anymore.
https://netzpolitik.org/2015/how-the-german-foreign-intellig...
> How does it reconcile with it taking nearly 17 years for Germany to outlaw BND from wiretapping DE-CIX?
He said only that "is regulated". This is the same like "CIA/NSA/FBI must obey the law". They actually do what they want. (Now the NSA is wiretapping DE-CIX and giving the info to BND)
The state has other laws that regulate its ability to spy on its citizens.
And if those laws become too cumbersome you can always ask a free friendly nation to do your spying for you, and get the info from them. And then cross your fingers that the judiciary will follow yout reasoning when you are found out.
We allow the state to levy taxes, expropriate, imprison, and even kill (war, death sentence) because we have democratically decided that it was necessary for the organisation of our society.
No country has total freedom of speech, not even the US. Try telling people you will kill the president, even as a joke, and the FBI will come knocking.
Amazon had a problem where they charge employees for the spent doing bag searches. If rather be video-recorded (temporarily) than wait in a bag searches line.
Also bag-searches seem more invasive than video.
>Also bag-searches seem more invasive than video.
Then don't do either. Or only do some random searches or when you're suspecting someone of having stolen something. Treating employees like thieves by default is nuts. We don't accept petty theft as a justification for mass surveillance outside the workplace so we shouldn't accept it inside the workplace either.
The majority of the cameras that I see on a daily basis are for petty theft. So much so that it’s a given in my head that a retail environment will be under video surveillance
You are choosing to work for a company. If the company wants to record you while you do your job that can very well be part of the contract you accept when starting to work.
Most of the offices I've worked at had surveillance, the supermarket I buy food from has surveillance, the shopping malls I visit have surveillance. Nobody is forcing you to go there and feel free to start your competing series of offices / supermarkets / shopping malls without surveillance; check if the market care instead of assuming this is what people want, before legislating and imposing regulations and fines.
The man on the other end of the gun certainly has a choice, and a negotiating position—they just aren’t very good ones, through no fault of his own.
I personally would prefer to live in a society where those with power don’t have moral carte blanche to treat those without power as badly as they like, as long as the unfortunates are technically given choices and/or some articulable market forces can reasonably be said to have been causal contributors to the current configuration of their reality. But I guess a lot of people, particularly people used to having power, may not agree with my preference.
You've got to look at the context. That type of surveillance happens where there's a massive power imbalance between employer and employee. Is the consent of someone who's at the bottom of the wage ladder and doesn't have an actual choice valid consent ? In Civil Law it certainly isn't.
Street crime is generally not committed by people accurately evaluating their options and making optimal choices with a long-term view.
The only way to know who is stealing is to either watch the drawer or to count the cash every time the employee walks away. Of course, most places go with the former as the latter is too time intensive (especially during a rush). The better solution (IMO) is to just count at the end of the day, and if there’s a discrepancy, mark it down. If it happens multiple times, you can compare who was at that register for each of those days and narrow it down.
At least in the grocery stores I frequent (Bay Area), the employee takes the drawer with them when they walk away (usually shift change) - clearly another option. I think they sign in/out too, so the drawer and the transactions are connected.
Regardless of theory, pay attention to where cameras in corner shops are pointed and I think you'll see what I've often seen: the cameras are primarily positioned to watch employees.
[0]: https://en.wikipedia.org/wiki/Derrick_Evans_(politician)
Why?
There is no correlation between the amount of surveillance and levels of crime (or even in the trend of levels of crime).
Entering the building is optional, even if you work there.
The ship of opting out of surveillance has sailed.
- They're typically not going to be watching it 24/7. They'll only look at the tapes if something occurs.
- Random bag checks, like in programming, is not really random. You either have a particular target or type in mind or you apply it to everyone and bag checks are a lot more invasive than video surveillance.
That’s how it is random. It’s milder because you get in trouble only if you have something in your bag that’s not supposed to be there and since it’s random you don’t feel targeted.
Since I already expect to be seen, one more person looking at me isn't a big deal. My public appearance is public, but my private things in my bag are not. It's incredibly uncomfortable (and IMO demeaning) to have someone examining the extra pair of underwear in your gym bag or skimming through your journal looking for proprietary info.
They would (presumably) not be allowed to read a journal for the purpose of theft detection. And if you would be made uncomfortable by something you brought to work, and it wasn't required for your job, you could leave it in a vehicle or at home. Sure, being able to bring it into work might be a personal convenience, for example if you take public transport and wanted to go to the gym before, during, or after work - but it's a choice. It isn't possible to opt out of surveillance.
And they can claim they didn't watch it at all? Total surveillance without specific reason and without information and consent is exactly what the law is trying to prevent.
> - Random bag checks, like in programming, is not really random. You either have a particular target or type in mind or you apply it to everyone and bag checks are a lot more invasive than video surveillance.
And that's the whole point. If there's a reasonable suspicion that someone stole something, they can ask to check the bag. The Person has the right to refuse that his bag be checked by company employees and ask to involve the police.
Why would the employee ask to involve the police? You can just refuse, period.
If your employer has evidence of a crime they're free to try to convince the police to get involved.
The interesting part is that your boss can't do much if he suspects theft besides calling a criminal investigation. I.e. it is difficult to fire an employee for that.
However, when safety is involved, things change. You can get fired for unboxing with the wrong knife. It is actually a side effect of employee protection laws. The employer is responsible for the safety of his employees, and if the employer have set rules for that purpose, not only he can take serious action if they aren't followed, but he has to, otherwise in case of an accident, he may be found responsible if the rules are not enforced.
So if you really want to fire someone, the best way is to argue that he is putting himself or others in danger. It includes hygiene concerns.
Search the web for "panopticon".
This is the kind of tortured thinking that lets The NSA look a judge in the eye and not laugh out loud as they say "Bulk internet collection is not 'surveillance' and so it doesn't require a warrant. It's only after we've keyword searched the data and then have a agent look at the returned results that it becomes 'surveillance'."
I'm sorry but words have meanings, and you don't get to make up your own meanings just because the law prohibits you under the well understood meaning of a word.
Video recording your employees 24x7 is creepy and wrong, no matter whether you never view the recordings or not.
You shouldn't be so quick to accuse someone of tortured thinking. From HN guidelines: "When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3.""
You probably would prefer neither over both. This case only says that doing constant video surveillance without sufficient cause is illegal. It doesn't say anything about the legality of constant searches without sufficient cause either, just that it may have been a better solution if they actually had a cause.
Where did you pull this from? It's random searches, occasional, and only if there's enough theft happening to justify it otherwise the searches would be illegal too.
Didn't we just have an article a few days ago about Google automating everything, and having absolutely meager human level support?
When (not if) those "Video Surveillance AI tools" come out, and can be hooked to a video surveillance system for 'automated anomaly detection', will they just be used as probable cause because some programmer with a classifier thinks you're at fault?
It's not hard to extrapolate 1 step into the future. Even Kroger and Walmart are doing that here. If an "anomaly" (aka: assumed theft) occurs, then flag a attendee to come over.
Random searches can be done effectively if they are truly random. Usually effective pilfering is done by employees who wouldn’t be tagged as a thief.
How is placing a camera different than hiring an overseer?
Computer monitoring and video surveillance at the workplace are outright verboten. This can be only a temporary measure in case of justified suspicion. That's nothing new and most companies of course comply. That's also why the fine is so high: That company behaved exceptionally bad.
This regulation is also less about the right to privacy (in the end it's about working environments) but about general personal rights. Constant monitoring at the workplace is just not compatible with the notion of human dignity. (Also it's stressful for the employees, makes them ill and wears them out, which is bad for productivity. Maybe this part is the real reason? ;-))
As you say, it’s a human rights issue. This case is GDPR. That could apply in cases where videoing itself is allowed, but, say, the videos are insufficiently protected against viewing by the general public.
This argument is the same one why nobody should be scared of a police search since you have not done something wrong. It is a consequence of privilege.
An imaginary world, where everyone is allowed to wiretap everyone non-stop, might be fine. But in the real world such ability is hindered by the morals, right of private property and major imbalance of power between people. As such, it is better to explicitly whitelist the few select cases, when surveillance is permitted — lest the society engages in race to the bottom, where every employer will try to give their workers as little privacy as possible.
I still don't see a problem with video surveillance, with full disclosure and proper access controls. What difference is there with police getting a warrant to search your house?
Can't believe it's illegal to record your premises
It's generally easier than going EU -> US, from my peers' experience.
That's common and easy in Sweden, "sponsorship" is cheap and doesn't require a lot from the employers
And get a visa, which depending on which country in europe you target will have different rules
Other than that, try and enjoy the adventure. I've been in Germany for almost ten years now...
1. https://en.wikipedia.org/wiki/Talk:Civil_forfeiture_in_the_U...
The only thing where there is a really obvious wrong incentive are parking violations, those go to the community, the community prosecutes and sets the local parking regs. So that, along with speeding tickets inside city limits (in parts), is a money-printing business for them.
If fines were distributed to the public and the ICO collected zero income, I believe the political will do finance it would disappear. I was not suggesting officers themselves would change priorities based on individual pay outs, sorry for the confusion.
It is a crime and the state fines the company for breaching the law.
You need to compensate these people... at least a little bit.
And given that basically all bigger German companies have a works council [1], this is really really likely to happen.
If there were punitive damages awarded to the victims, a lot more illegal behaviour would be properly prosecuted. Officials like the state data protection officer are intentionally understaffed, so they only prosecute the most egregious problems. Private citizens and their attorneys could take up the slack if it were financially viable.
I can assure that this is not an issue for Germany. If anything they are overstaffed based on the false and egregious bullshit I have had to pay lawyers to get overturned.
The solution to weak law enforcement is to give more power to the law enforcement, not to a selected class of privileged people.
Then you have to balance it out with harsh punishments for unsubtantiated lawsuits but that could sometimes affect legit victims that were just short of evidence. It's better to not have the problem in the first place.
It would be better to just burn the money then to give it to the victims.
Victim separately could prove what actual harm was done and request support, but this should be completely separate process ideally financed separately, that disregards how rich is the perpetrator or how severele he violeted the law.
Same way money from fines shouldn't land anywhere near the cops that give the fines because this creates perverse incentive.
We're trying to strike a reasonable ballance:
For our business we have an inventory room that is under full and complete survalence - but the rest of the office has none.
It is called "Datenschutz", and you see people proactively adhering to it, needed some time as a foreigner to get used to how rigorously they apply it, but when I got used to it, felt "safer" knowing whoever handles my data, knows how sensitive it is.
See https://de.wikipedia.org/wiki/Datenschutz for more information about the history.
Are employees going to be fired because their privacy was being infringed?
Yeah, may backfire on employees but this fine is not about the employees but the company violating a law.
The legal framework is rather easy (and hasn't changed with GDPR, as far as I can tell): video surveillance is generally illegal. There are specific circumstances where it is legal, and those tend to require two things:
- there needs to be some "risk" that is higher than usual, and where video surveillance can make a difference.
- it's extremely hard to justify surveillance of spaces where people regularly spend long amounts of time, such as their workplace.
Generic offices fail both tests: what, exactly, are you looking for? Stapler thefts? And, at the same time, the intrusion is rather is far more significant than, say, a public transit station that you pass through.
Numbers are made up :)
NBB laptops found to have hardware back door, apparently installed by rogue worker who was NSA agent at factory.
BUT I believe it is required to face the customer area (and, therefore, film employees mostly from the back). There's also usually a "pit"-like work area that's employee-only and I would imagine that's out of bounds, as well.
But I'm getting the impression that the authorities prefer to look into local companies where "easy wins" can be had - like in this article.
Let's get this straight: I think the video surveillance here was not okay.
But - shouldn't the authorities rather pursue things which matter more, i.e. maximising the impact of (number of humans affected * magnitude of effect)? The WhatsApp <> Facebook data sharing situation comes to mind. Or the recent change of their privacy policy.
There's lots more. I feel that big (SV) tech companies have much more leeway than local companies, simply because their probability of being fined is lower.
Source: https://www.forbes.com/sites/carlypage/2021/01/08/whatsapp-t... says "In a statement given to Forbes, a WhatsApp spokesperson confirmed that there will be no changes to WhatsApp’s data-sharing practices in Europe and the UK."
If it is indeed not harmful like Facebook is claiming to be by pushing WhatsApp status updates, they can choose to do it in EU also.
I wonder how Facebook treats traffic coming through its TOR address.
"Germany’s federal and regional data protection authorities have been keen to focus on steering organizations away from “common” privacy violations under the GDPR—such as video monitoring, cold-calling, etc.—rather than pursuing record fines. Regulators feel such an approach creates a greater understanding of what privacy means and how the GDPR impacts people and work on a day-to-day basis."
I imagine similar thinking applies in other EU countries. Though I sure wish they'd deal with the telemarketers and websites with GDPR-non-compliant GDPR forms already!
Big companies are investigated, but a) for more nebulous cases the processes take longer, b) rules to avoid parallel investigations in many places also apply to the tech companies, which takes time for international coordination and somewhat restricts local agencies from acting against them (which is a bit of a loophole, or at least delays it further - see the various Schrems cases against Ireland), c) Whatsapp/Facebook have backed off from some things in Europe already due to previous investigations and agreements around the aquisition.
Pretty much everyhwere, the privacy agencies are working on extremely limited resources, and can not address everything at once. (Yes, this is a problem)
Could the punishment be more swift, more consistent and hurt more? Sure! But they are definitely not turning a blind eye either.