Go to Wolters Kluwer VitalLaw.comGo to Wolters Kluwer VitalLaw.com
VitalLaw®
  • Find answers to your questions
  • Log in to access your subscriptions
In depth. On point.
In depth. On point.
  • Home
  • Legal Directory
  • Home
  • Legal Directory
In depth. On point.
  • Articles
    • Articles
  • Organizations
    • Organizations
    • ‘Coordinated’ Attacks on Electric Grid Prompt Proposal for Stronger Cyber Defenses
    • Cybersecurity Demands, Resource Limitations Seen Straining Open-Source Software Community
    • Legislation to Update Data Broker Requirements Sent to Gov. Newsom
    • Recording Devices Lead to Privacy Fine for French Retailer
    • Revisions to EU Privacy Fines Unnecessary After Court Ruling, EDPB Says
    • Rules on ADMT, Risk Assessments, Cyber Audits Get Legal Clearance in California
    • Secret Service Dismantles Telecom-Related Threats in New York City Region
    • Social Media ‘Delete’ Button Legislation Sent to California Governor
    • Sprint, T-Mobile Ask D.C. Circuit to Rehear Ruling on FCC’s Privacy Fines
    • Use of Facial Recognition Tech Will Be Assessed Case-by-Case, Australian Regulator Says
  • Articles
    • Articles
  • Organizations
    • Organizations

    Cybersecurity Policy Report, Recording Devices Lead to Privacy Fine for French Retailer, (Sep 23, 2025)

    By Tony Foley

    The French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), announced today that it had fined department store La Samaritaine SAS 100,000 euros ($118,152) based on violations of the European Union&# ...

    By Tony Foley

    The French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), announced today that it had fined department store La Samaritaine SAS 100,000 euros ($118,152) based on violations of the European Union’s General Data Protection Regulation (GDPR) related to the installation of cameras in its warehouse.

    In a press release today, CNIL said that, due to increased thefts of merchandise, Samaritaine installed sound-recording cameras resembling smoke detectors in two of its warehouses that were not visible to employees in August 2023. CNIL conducted an inspection after reading a news article and receiving a subsequent complaint reiterating the facts alleged in the article.

    In its decision last week, CNIL said Samaritaine failed to comply with its obligation to process data fairly, as well as failing to comply with the principle of accountability under article 5(1)(a) and 5(2) of the GDPR. In general, CNIL said, video surveillance cameras must be visible, but in certain exceptional circumstances, may be installed in an area not visible to employees. Samaritaine did not carry out any prior analysis of compliance with the GDPR nor did it document the temporary nature of the installation, which was discovered by employees a few weeks after its deployment.

    CNIL also found that Samaritaine violated article 5(1)(c) of the GDPR by failing to comply with the obligation to collect adequate, relevant, and non-excessive data, observing that the cameras at issue were equipped with microphones and that personal conversations between employees were recorded. Finally, CNIL concluded that Samaritaine did not inform its data protection officer of its intention to install hidden cameras in storage areas until several weeks after deployment, meaning that the DPO could not alert the company to the means that should have been used to limit risk to the protection of employee data. Accordingly, CNIL said, Samaritaine violated GDPR article 38(1).

    News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR

    © 2026 CCH Incorporated and its affiliates and licensors. All rights reserved.

    • Manage Cookie Preferences
    • Privacy Statement
    • Terms of Use