---
title: "H&M Hennes & Mauritz Online Shop A.B. & Co. KG fined EUR 35,258,707.95 (Germany, 2020)"
canonical: "https://dposchool.com/gdpr/fine/hmbbfdi-hm-2020-10"
source: "https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Pressemitteilungen/2020/2020-10-01-H_M.pdf"
source_note: "Only the authority's decision is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Fine · Germany

# H&M Hennes & Mauritz Online Shop A.B. & Co. KG: EUR 35,258,707.95

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Authority:** Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI)
- **Country:** Germany
- **Date:** Announced on 1 October 2020
- **Amount:** EUR 35,258,707.95, as imposed (not converted)
- **Appeal status:** Unknown
- **Provisions cited:** The authority's published text cites no article numbers.

## What the fine was for (summary, not the official text)

Service-centre managers recorded and stored detailed notes on hundreds of employees' private lives, health and religious beliefs after 'welcome back' talks, and used them to profile staff.

Not fully confirmed: Press release of 1 October 2020; it gives the exact amount and name but cites no GDPR article numbers, and the fine notice's own date is not stated.

## Official source

- [Decision or announcement of the authority](https://datenschutz-hamburg.de/fileadmin/user_upload/HmbBfDI/Pressemitteilungen/2020/2020-10-01-H_M.pdf)

Checked against the official source on 28 October 2026.

Only the authority's decision is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Fines](https://dposchool.com/gdpr/fines) / H&M Hennes & Mauritz Online Shop A.B. & Co. KG

[All fines](https://dposchool.com/gdpr/fines)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents