VG Hannover - 10 A 5144/23

Summary

A German court has upheld a Data Protection Authority's decision to fine a doner kebab production facility for extensive video surveillance of its employees. The court ruled that the surveillance lacked a legal basis under GDPR, violated principles of lawfulness and storage limitation, and that issuing both a reprimand and a fine did not constitute double punishment.

Full text

Help VG Hannover - 10 A 5144/23: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit →VisualWikitext Revision as of 12:24, 9 September 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators180 edits Tag: Visual edit← Older edit Revision as of 16:50, 15 September 2026 view source Ls (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators421 editsTag: Visual editNewer edit → (One intermediate revision by the same user not shown)Line 105: Line 105: === Facts ====== Facts === The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. There were cameras outdoors in the parking lot, the goods receiving and shipping areas, production area, the office, and staff break rooms. The comprehensive surveillance of employees (the data subjects) was discovered during an inspection by the labour inspectorate in June 2022.The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the parking lot, the goods receiving and shipping areas, production area, the office, and staff break rooms. The DPA started investigating the controller's processing operations after the labour inspectorate had informed it about the video surveillance. In September 2023, the DPA issued a decision where it reprimanded the controller for violations of the principle of lawfulness and storage limitation, lack of legal basis for the processing, and the obligation to maintain a record of processing activities. The monitoring of employees (the data subjects) was discovered during a labour inspectorate inspection in June 2022, which informed the DPA. In addition, the DPA issued the controller a fine for the violations of the principles of lawfulness and storage limitation. The amount of the fine was reduced to €8,000 by a decision of the Local Court Hannover (Amtsgericht Hannover).In September 2023, the DPA reprimanded and fined the controller for violations of the principle of lawfulness and storage limitation, lack of legal basis for the processing, and the obligation to maintain a record of processing activities. The controller appealed the DPA decision and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the prohibition against double punishment.<u>Upon controller's appeal</u>, the amount of the fine was reduced to €8,000 by a decision of the Local Court Hannover (Amtsgericht Hannover). The controller appealed the DPA decision and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the general prohibition against double punishment. === Holding ====== Holding === The court dismissed the appeal and upheld the DPA decision. It held that the controller had violated [[Article 5 GDPR|Articles 5(1)(a)]], [[Article 5 GDPR|5(1)(e)]], [[Article 6 GDPR|6(1)]], and [[Article 30 GDPR|30 GDPR]]. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of a GDPR violation but does not serve a punitive purpose.The court dismissed the appeal and upheld the DPA decision. It held that the controller had violated [[Article 5 GDPR|Articles 5(1)(a)]], [[Article 5 GDPR|5(1)(e)]], [[Article 6 GDPR|6(1)]], and [[Article 30 GDPR|30 GDPR]]. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of a GDPR violation but does not serve a punitive purpose. The court concluded that there was no legal basis for the comprehensive surveillance of employees under [[Article 6 GDPR|Article 6(1) GDPR]]. As a result, the controller had also violated the principle of lawfulness. First, the court found that the processing could not be based on [[Article 6 GDPR|Article 6(1)(a) GDPR]]: the controller had not provided any evidence that the employees would have consented to the comprehensive surveillance.The court qualified the camera monitoring of comprehensive surveillance of the controller's employees. Regarding the lawfulness of the processing, the court examined whether consent or legitimate interest could be relied upon. For consent, the court found that the processing could not be based on [[Article 6 GDPR|Article 6(1)(a) GDPR]]: the controller had not provided any evidence that the employees would have consented to the processing. Second, the court held that the controller could not rely on legitimate interests under [[Article 6 GDPR|Article 6(1)(f) GDPR]] either, as no balancing test between the controllers' interest to monitor its premises and the rights and freedoms of the data subjects had been conducted. In addition, the court pointed out that neither compliance with hygiene regulations nor the prevention of burglaries and vandalism could constitute legitimate interests in the present case. Regarding hygiene, the court pointed out that the controller was required to comply with hygiene provisions by law as a business that processes food of animal origin. There was also no factual evidence for crimes mentioned by the controller being a threat in the area.The controller could not rely on legitimate interests under [[Article 6 GDPR|Article 6(1)(f) GDPR]] either, as no balancing test had been conducted. In addition, the court pointed out that neither compliance with hygiene regulations nor the prevention of burglaries and vandalism could constitute legitimate interests in the present case. Regarding hygiene, the court pointed out that the controller was required to comply with hygiene provisions by law as a business that processes food of animal origin. There was also no factual evidence for crimes mentioned by the controller being a threat in the area. Furthermore, the court held that the controller had infringed the principle of storage limitation by storing the video surveillance footage for longer than necessary: some data had been stored for years. Finally, the court confirmed that the controller had also violated [[Article 30 GDPR|Article 30(1) GDPR]] as it had not provided a record of processing activities despite the DPA's repeated requests.Furthermore, the court held that the controller had infringed the principle of storage limitation by storing the video surveillance footage for longer than necessary: some data had been stored for years. Finally, the court confirmed that the controller had also violated [[Article 30 GDPR|Article 30(1) GDPR]] as it had not provided a record of processing activities despite the DPA's repeated requests. Revision as of 16:50, 15 September 2026 VG Hannover - 10 A 5144/23 Court: VG Hannover (Germany) Jurisdiction: Germany Relevant Law: Article 5(1)(a) GDPR Article 5(1)(e) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 30(1) GDPR Decided: 07.08.2026 Published: 09.09.2026 Parties: National Case Number/Name: 10 A 5144/23 European Case Law Identifier: Appeal from: Appeal to: Unknown Original Lan

Entities