Fashion and Luxury Newsletter

CNIL fines a French department store €100,000 for GDPR violations related to hidden surveillance cameras

On 18 September 2025, the French Data Protection Authority (CNIL) fined a French department store €100,000 for multiple infringements of the General Data Protection Regulation (GDPR) following the installation of hidden video and audio surveillance devices in its stockrooms.

In August 2023, after an increase in thefts of stock, the French department store installed cameras disguised as smoke detectors in two different areas. The devices, capable of recording both video and audio, were discovered by employees and removed in September 2023. The CNIL was alerted by a press article published on 25 November 2023, followed by a formal complaint.

After investigating, the CNIL found breaches of Articles 5(1)(a) and 5(2) of the GDPR. Hidden cameras may be used only in exceptional circumstances and under strict conditions, after conducting a documented GDPR compliance analysis and with a clear justification for their temporary use. The CNIL also found that recording employee conversations via the cameras’ microphones breached the data minimisation principle.

The French department store: (a) failed to conduct a comprehensive analysis before installing the cameras; (b) did not document the temporary nature of the installation; and (c) did not include the devices in its processing register and its data protection impact assessment. Also, the store’s Data Protection Officer (DPO) was not informed beforehand and could not advise on risk mitigation measures.

The CNIL’s decision serves as a reminder that legitimate security concerns do not exempt companies from their GDPR obligations. Covert surveillance must remain temporary, proportionate and documented. Companies in high-value sectors, such as fashion and luxury brands, should ensure proper documentation of processing activities, involve their DPO at an early stage, and avoid excessive data collection (as should companies in all sectors).

Luxury brands in the AML spotlight

In July 2025, Dutch authorities opened an investigation into suspected money laundering through repeated high-value purchases in the luxury sector. According to the Dutch prosecutors, the relevant buyer structured transactions just below the €10,000 cash-reporting threshold, used multiple identities and arranged for goods to be shipped abroad. Crucially, the investigation did not stop at the customer; the luxury goods seller was also targeted, as the authorities deemed that the seller failed to take appropriate steps, such as asking for identification or questioning the pattern of purchases. 

This case underscores a pivotal shift, with luxury goods sellers now emerging as prime targets for regulatory scrutiny. Under the EU’s new “AML Package” (which is a set of legislation formally adopted by the EU last year to strengthen the rules combatting money laundering and terrorist financing), the existing obligations for high-value goods dealers are being significantly expanded and harmonised. Luxury brands face a wave of greater compliance obligations, including cash transaction caps, enhanced due diligence and stringent reporting requirements. As the different legative aspects of the AML Package will continue to enter into force in the next few years, to mitigate regulatory, reputational, and operational risks, companies must act swiftly by assessing their exposure, training staff on the new requirements and proactively reviewing and updating their internal compliance frameworks.

Commission approves Warburg Pincus acquisition of UVEX Group

On 26 August 2025, the European Commission received notification of a proposed concentration pursuant to Article 4 of the EU Merger Regulation (EUMR), by which Warburg Pincus LLC would acquire control of the whole of UVEX WINTER HOLDING GmbH & Co. KG, all its direct and indirect subsidiaries, and UVEX WINTER HOLDING Management GmbH.

Warburg Pincus is a private equity firm managing companies active in various sectors, including consumer, energy, financial services, healthcare, industrial and business services, and technology, media and telecommunications. UVEX Group is a German company which specializes in the development, production and distribution of personal protective equipment and safety products mainly for sports.

After examining the transaction, the Commission concluded that it fell within the scope of the EUMR. However, the Commission found no competition concerns and cleared the transaction unconditionally at Phase 1 on 18 September 2025.