Spain’s top labour court voids H&M bag checks: control is not proof

Here is a test you can run on any control measure in your business: ask what it would prove in front of a judge. Spain’s National Court just ran that test on H&M, and the answer was brutal. The retailer had staff bags visually checked at the door every single day after clock-out, and lockers opened at random once a month. When the court asked for the numbers behind it, the theft losses, the share actually traceable to employees, any concrete facts at all, the company had nothing to show. Years of checking, zero evidence produced.

The ruling came from the Sala de lo Social of the Audiencia Nacional on 27 July 2026, after a claim brought by the UGT union with CCOO joining, and it declared both practices null: the daily visual bag check at the end of the shift and the random locker searches. The legal ground is worker privacy, protected in Spain by article 18 of the Workers’ Statute and by the Constitution itself. The employer’s power to supervise exists in Spanish law, the court was clear about that, but it demands a concrete justification. Generic suspicion aimed at your entire workforce does not qualify.

Strip away the Spanish specifics and the case travels well, because the logic behind those bag checks is not Spanish at all. It is the same instinct that makes a manager anywhere ring the crew three times an afternoon to ask where the van is, or demand a photo from site “just to see you’re there”. When a business has no reliable record of the work itself, it falls back on watching the people. And watching the people, this ruling says in black and white, is the expensive option: it poisons trust across the whole team, it produces no usable data, and when it lands in front of a court you get to explain why you frisked everyone for years without a single number to justify it.

Control is a habit. Proof is a system.

Notice what H&M actually lacked. Not cameras, not security staff, not procedures: they had plenty. What they lacked was evidence. That is the trap with control rituals, they feel like management while producing nothing you can use. A bag opened at the door proves the bag was opened, nothing more. Meanwhile the questions that actually decide disputes, who was on site, when the job started, what was done and where, stay unanswered, because nobody built a record of the work while it happened.

If you are reading this from outside Spain, resist the urge to file it under “foreign court, foreign problem”. The proportionality test the Audiencia Nacional applied, a concrete justification before you intrude on workers, is the same one the ICO expects from UK employers in its monitoring guidance, and the same one every GDPR authority on the continent works from. The jurisdictions differ in the details, the question never changes: could you show a judge the facts that made your control measure necessary? H&M could not, and the measure died in court.

European regulators have been drawing this exact line for years, and not only in Spain. The Spanish data protection authority alone has sanctioned workplace surveillance dozens of times, and its colleagues from Italy to the Netherlands keep the same pace. We collect those decisions, country by country, in our observatory of European rulings on employee monitoring, and reading them side by side teaches one lesson fast: authorities do not punish employers for wanting to know what happens in their business. They punish them for finding out by intruding on people instead of recording the work. If you operate in Spain or send crews there, the full national picture is in the Spain page of our GPS and workers guide.

---

What would you hold up in that courtroom?

Picture the same scene with the roles reversed. A client disputes an invoice, an inspector asks for your team’s hours, a court wants to know who was where. The business built on control rituals stands there like H&M did, with years of activity and nothing to show. The business that records the work, a verified clock-in with time and place, evidence attached to each job, does not need theatre at the door. Its proof exists because the work created it, and it never had to look inside anyone’s bag to get it.

That is the line we built GeoTapp on: the day’s work of a field team, proven by GPS-verified clock-ins at the moment of the job, no continuous tracking of anyone, data stored in Europe. The distinction the Spanish court just enforced is the same one the software draws, proof belongs to the work, privacy belongs to the person.

So, honest question: how much of what your company calls control would survive the judge’s test, and how much is just habit? Tell me in the comments.

If you want to see what a fully proven working day looks like without watching anyone, start with tomorrow’s first job.

Sources

Poder Judicial, The Audiencia Nacional voids H&M’s visual bag checks and random locker searches · Infobae, Audiencia Nacional declares H&M’s daily bag and locker searches illegal