The Spanish Data Protection Agency (AEPD) has imposed a €70,000 fine to LVMH Iberia, the Spanish branch of the French luxury and cosmetics giant. Why? Because the company added a worker to a WhatsApp group chat for work using her personal phone number without asking her first.
According to the AEPD’s ruling, LVMH Iberia violated regulations on the lawful processing of personal information and the right to digital disconnection. So, let’s talk a bit more about this situation.
How everything started
During the labor relationship with LVMH Iberia, the worker had to use her personal phone number for work issues because the company asked her to do it while waiting to receive a corporate phone number that never came. The worker explained that, with the passage of time, other work partners that started to work in the company after her, did receive those corporate phone numbers except for her.
So, when they all came back from vacation, the workers decided to stop using her personal phone because of working reasons. She stated this in a clear and polite way to her supervisors via e-mail and also verbally. In the following message, she explained:
“The reason for this email, as I’ve already mentioned to some of you, is that I’ll be starting my holidays on Saturday and will no longer use my personal phone for work matters as I have until now, given the delay in receiving the ICON (corporate phone). I hope to have the company phone soon. For now, I’ll stay in touch with my existing clients, but I won’t share my personal number with new ones. I’ll also carry my phone so you can reach me if needed while I’m in-store. I’ll leave all WhatsApp groups at the end of my shift on Friday.”
This way, the worker notified the company in advance that she would leave the WhatsApp group chats for work and that she would stop using her personal phone for labor tasks during her vacations.
What did LVMH Iberia do after that?
Despite her notification, a few days later, while the worker was on vacation, a person from the company added her personal phone number to the WhatsApp group chat from work once again, with no notification or consent. So, the worker stayed in the group, even during her free time, until a few weeks later when she was fired and they removed her from the group.
After what happened, the worker decided to file a complaint with the Spanish Data Protection Agency (AEPD), considering that the company violated the worker’s privacy and her right to disconnect from her job.
LVMH Iberia defense
The company defended itself by arguing that it had always acted in a “guaranteed and respectful” manner. It stated that the intention was never to invade the worker’s privacy and that it respected her decision of taking no part in the WhatsApp group chats during her vacations.
According to the company, the e-mail sent by the worker didn’t mention a permanent removal, instead it only showed that she would leave the groups during her resting time. For that reason, the company claimed it had interpreted her message correctly and acted with caution and respect, believing she only wished for a temporary disconnection, not a permanent one.
AEPD’s decision
The AEPD didn’t accept the company’s reasons. The agency considered that LVMH Iberia unlawfully processed personal data, because it used the employee’s private phone number without her explicit consent.
The ruling stated that the company’s internal documents clearly showed that the worker’s personal phone number had been used to include her in a work-related WhatsApp group without authorization.
The AEPD also ruled that LVMH Iberia had violated the employee’s right to digital disconnection, as she was added to the group during her vacation, a period when she had every right not to receive work-related messages.
What the law says
The law protects every worker who doesn’t want to share their personal data with the company they work at. In fact, a 2015 Supreme Court ruling annulled a standard employment contract clause that forced employees to provide their personal phone number or email address so that companies could contact them about work matters such as schedule changes or even dismissals.
The court considered that kind of clause “abusive”, affirming that workers cannot be forced to share personal contact details with their employer.
Final outcome
Ultimately, LVMH Iberia was fined €70,000 for violating the General Data Protection Regulation (GDPR) and the right to digital disconnection. However, the company acknowledged its responsibility in the incident and paid €42,000 after applying two legal reductions: one for accepting liability and another for paying early. Do you think the worker was right?