What happened
France’s data protection authority, CNIL, inspected Amazon France Logistique’s offices and two of its warehouses in November 2019, according to the Conseil d’État. On 27 December 2023 CNIL fined the company 32 million euros over data that handheld scanners generated and stored about warehouse workers, and over failures involving information given to workers and the security of video surveillance software.
According to the court, the scanners automatically generated detailed indicators about workers that managers could see. One, called “stow machine gun”, flagged two barcode scans less than 1.25 seconds apart while an employee was stowing items. “Idle time” flagged more than ten consecutive minutes without scanner activity. “Temps de latence” recorded inactivity for a limited period immediately before or after breaks. All quality and productivity indicators were kept for 31 days.
On 23 December 2025 the Conseil d’État, France’s highest administrative court, reduced the fine to 15 million euros.
What an auditable version would have shown
The court overturned CNIL’s findings that processing the three indicators lacked a lawful basis. It said the “stow machine gun” indicator could not be regarded as imposing speed requirements. On idle time and latency, it said employees might have to give managers reasons touching on their private lives, so the processing was not without effect on privacy. It found that effect was not excessive.
The court upheld CNIL’s finding that keeping all the indicators indiscriminately for 31 days, across different purposes, breached the GDPR’s data minimisation principle. It said the burden was on the company to show why each indicator needed to be kept that long. CNIL did not have to show that less data, kept for less time, would have worked as well.
An auditable record would have shown what data was being kept, what purpose it served and how long that purpose required it.
Where the gap was
According to the court, CNIL had found the nature, number and very high precision of the stored data disproportionate, as well as the retention period. The court upheld the finding of serious negligence and said the company could not have been unaware that its conduct was an infringement.
A MetricRecord is designed to hold aggregate figures, such as productivity by team, bound to the underlying records so they can be checked.
A ConductRecord keeps each indicator the system generated and the purpose it was recorded for.
MetricRecord and ConductRecord are Headlights designs.
What governance should have looked like
According to the court, Amazon France Logistique did not contest CNIL’s findings on information given to temporary workers, information about video surveillance at two warehouses, and the security of access to video surveillance software for some cameras in one warehouse.
Where an automated system generates detailed data about individual workers, best practice would be to decide how long each kind of data is needed for each purpose and to be able to justify that period.
Failure Pattern: according to France’s highest administrative court, warehouse scanners automatically generated detailed indicators about each worker, and the employer kept all of them for 31 days across several purposes without being able to show why that was necessary.
Governance Principle: an organisation whose automated systems generate personal data about workers should be able to show, for each kind of data, why it is kept and why for that long.
The reference implementation of MetricRecord and ConductRecord is open source. It lives at github.com/saffronandindia/headlights-oss, Apache 2.0 licensed and free to install. The repository is public now.