Overview

• The French data protection authority said it pronounced the €100,000 penalty on 18 September 2025 and disclosed the decision on 23 September.
• Cameras disguised as smoke detectors with audio capability were installed in two stockrooms in August 2023 to address thefts, according to the decision.
• Employees discovered the devices, which were then removed in September 2023 after only a few weeks in place.
• The Cnil cited failures including no prior GDPR conformity analysis, no documentation of the temporary setup, excessive audio collection, and delayed involvement of the data protection officer, alongside breaches of fairness, accountability and data minimization principles.
• The watchdog reiterated that hidden workplace surveillance is allowed only in exceptional, temporary cases following a documented proportionality review, noting that a Médiapart article and subsequent complaint triggered its checks.