On September 28, 2023, the French data protection authority (CNIL) published Deliberation SAN-2023-013 of September 18, 2023, in which it imposed a fine of €200,000 on SAF Logistics for violation of the General Data Protection Regulation (GDPR), following a complaint.

Background to the case

CNIL clarified that SAF Logistics is an air freight company, whose parent company is located in China. Furthermore, CNIL highlighted that it received reports from employees of SAF Logistics that as part of internal recruitment for a position within the company, SAF Losigstics was collecting personal data relating to the private lives of its employees. Specifically, CNIL noted that it received two complaints from employees that all staff had received forms in Chinese language to provide personal data such as ethnicity, affiliation to a political party, familial situation, as well as the names of parents and siblings.

Findings of CNIL

CNIL determined that the form sent to its employees collected too significant an amount and variety of personal information regarding employees' private lives, violating the principle of data minimization under Article 5(1)(c) of the GDPR. Likewise, CNIL recognized that the personal data requested of employees in the forms sent out included sensitive data such as ethnicity and political affiliation and that SAF Logistics failed to meet any of the conditions necessary to collect sensitive data under Article 9(2) of the GDPR.

CNIL found that SAF Logistics kept extracts of employees' criminal records, even after relevant employees had been cleared by authorities following administrative inquiries. Accordingly, the retention and consultation of employees' criminal records following clearance was considered to be in violation of Article 10 of the GDPR.

Finally, with specific reference to the forms provided to employees which requested the provision of sensitive personal data, CNIL noted that SAF Logistics did not provide correct translations of such forms. Notably, CNIL detailed that the French translations of the forms, which were originally in Chinese, had fields relating to ethnicity and political affiliation removed. Further, CNIL noted that although SAF Logistics received a letter from CNIL on August 13, 2020, regarding the requests for sensitive personal data, SAF Logistics continued to send the form to employees. Consequently, CNIL determined that SAF Logistics' declarations contradicted its actions and displayed an unwillingness to cooperate with CNIL, preventing CNIL from exercising its supervisory powers, in violation of Article 31 of the GDPR.

Outcomes

In conclusion, CNIL imposed a fine of €200,000 on SAF Logistics for the aforementioned violations.

You can read the press release here and the decision, only available in French, here.