VG Hannover - 10 A 5144/23

Summary

A German administrative court has upheld a €8,000 fine and reprimand against a doner kebab production facility for unlawfully surveilling employees. The court found violations of GDPR principles, including lack of legal basis and storage limitations, and ruled that the surveillance in break rooms, production areas, and outdoor spaces was excessive. The court also clarified that a reprimand and a fine for the same violations do not constitute double punishment.

Full text

Help VG Hannover - 10 A 5144/23: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 12:21, 9 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators173 edits Tag: Decisions [1.0]Newer edit → (No difference) Revision as of 12:21, 9 September 2026 VG Hannover - 10 A 5144/23 Court: VG Hannover (Germany) Jurisdiction: Germany Relevant Law: Article 5(1)(a) GDPR Article 5(1)(e) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 30(1) GDPR Decided: 07.08.2026 Published: 09.09.2026 Parties: National Case Number/Name: 10 A 5144/23 European Case Law Identifier: Appeal from: Appeal to: Unknown Original Language(s): German Original Source: juris (in German) Initial Contributor: av A court upheld a reprimand and a fine of €8,000 issued to a doner kebab production facility for unlawful video surveillance of employees in both indoor and outdoor areas of the business premises, including staff break rooms. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. There were cameras outdoors in the parking lot, the goods receiving and shipping areas, production area, the office, and staff break rooms. The comprehensive surveillance of employees (the data subjects) was discovered during an inspection by the labour inspectorate in June 2022. The DPA started investigating the controller's processing operations after the labour inspectorate had informed it about the video surveillance. In September 2023, the DPA issued a decision where it reprimanded the controller for violations of the principle of lawfulness and storage limitation, lack of legal basis for the processing, and the obligation to maintain a record of processing activities. In addition, the DPA issued the controller a fine for the violations of the principles of lawfulness and storage limitation. The amount of the fine was reduced to €8,000 by a decision of the Local Court Hannover (Amtsgericht Hannover). The controller appealed the DPA decision and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the prohibition against double punishment. Holding The court dismissed the appeal and upheld the DPA decision. It held that the controller had violated Articles 5(1)(a), 5(1)(e), 6(1), and 30 GDPR. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of a GDPR violation but does not serve a punitive purpose. The court concluded that there was no legal basis for the comprehensive surveillance of employees under Article 6(1) GDPR. As a result, the controller had also violated the principle of lawfulness. First, the court found that the processing could not be based on Article 6(1)(a) GDPR: the controller had not provided any evidence that the employees would have consented to the comprehensive surveillance. Second, the court held that the controller could not rely on legitimate interests under Article 6(1)(f) GDPR either, as no balancing test between the controllers' interest to monitor its premises and the rights and freedoms of the data subjects had been conducted. In addition, the court pointed out that neither compliance with hygiene regulations nor the prevention of burglaries and vandalism could constitute legitimate interests in the present case. Regarding hygiene, the court pointed out that the controller was required to comply with hygiene provisions by law as a business that processes food of animal origin. There was also no factual evidence for crimes mentioned by the controller being a threat in the area. Furthermore, the court held that the controller had infringed the principle of storage limitation by storing the video surveillance footage for longer than necessary: some data had been stored for years. Finally, the court confirmed that the controller had also violated Article 30(1) GDPR as it had not provided a record of processing activities despite the DPA's repeated requests. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Hanover Administrative Court, 10th Chamber, Judgement of August 7, 2026, Case No.: 10 A 5144/23 EUV 2016/679 para 58(2)(b), EUV 2016/679 § 58(2)(i), EUV 2016/679 § 83(2), BrandSchG SL § 26, The plaintiff challenges, among other things, the defendant’s data protection warning regarding video surveillance at the plaintiff’s facility. The plaintiff is an enterprise that produces meat for kebabs. During an inspection by the Braunschweig Labor Inspectorate on June 17, 2022, it was noted that images from several surveillance cameras were visible in the office of the plaintiff’s managing director. The Trade Supervisory Office informed the defendant of this, and the defendant, as the supervisory authority for data protection, initiated an investigation and requested the plaintiff to submit comments in response to a questionnaire. The plaintiff refused to comment, invoking the right to remain silent because answering the questions could expose it to the risk of criminal or administrative prosecution. The plaintiff also submitted a written statement from an employee in which the employee consented to video surveillance at the workplace at the following locations: production area, parking lot, office, break room, and goods receiving/shipping areas. The defendant subsequently applied to the Hanover Local Court for a search and seizure warrant. Pursuant to the order, the plaintiff’s business was searched on December 15, 2022, by the local police; a video server was seized and examined by the Salzgitter/B-Stadt/Wolfenbüttel Police Department. The police reported that the video server’s hard drive contained 76,421 images and one video file. During the search, it was determined that the plaintiff conducted surveillance on her enterprise with 13 cameras. The surveillance covered the outdoor area, the production area, the office, and the break room. Outside, signs indicating Surveillance were posted, while no such signs were found inside the building. Both the managing director’s office and the employees’ office contained monitors displaying Surveillance footage. At the time of the search, visitors were present in the employees’ office in addition to the employees. The father of the plaintiff’s managing director at the time stated that the video surveillance was conducted to protect against break-ins. In a letter dated February 10, 2023, the defendant initially notified the plaintiff of the planned directive to deactivate the indoor cameras during business hours and to exclude public thoroughfares from the surveillance coverage in the outdoor area, to prevent third parties from gaining unauthorized access to the monitors displaying the surveillance footage, to post signage with the necessary notices regarding video surveillance, and to submit a record of processing activities. The plaintiff subsequently stated that the indoor cameras had already been deactivated. It would exclude public traffic areas from the coverage of the outdoor cameras. It currently operates only one doorbell camera. The monit

Entities