€400,000 for unnecessarily collecting data on striking workers

France: CNIL fines Régie Autonome des Transports Parisiens (RATP) €400,000 for unnecessarily collecting data on striking workers. The Paris public transport operator included information on the number of days of participation in strikes in personnel files. The information was used to evaluate employees for the purposes of the promotion system. In addition, the CNIL found that RATP kept employee evaluation files for more than three years, whereas they only needed to be kept for 18 months. RATP also uses an application to monitor employee activity. However, this application does not have differentiated levels of user rights – authorised staff had access to all categories of data contained in the application without distinction based on their responsibilities. The scale of the irregularities and their nature had an impact on the penalty.