Business Insider reports that H&M has been fined $41.1 million by a German regulator.
The company was caught monitoring "several hundred employees" at its service center in Nuremberg, Germany.
In 2018 The EU introduced new General Data Protection Regulation laws.
This is the second-largest fine levied against a single company over data breaches since the 2018 laws were put into effect.
Since 2014 supervisors and managers at H&M have been storing data on employees.
The data includes information from meetings and workplace conversations, such as medical symptoms, family issues, and religious beliefs.
This data was sometimes used to make employment decisions.
H&M compensated all affected staff, and said that the company views privacy and data protection as "top priority."