VG Hannover - 10 A 5144/23

Summary

A German court has upheld a reprimand and an €8,000 fine against a doner kebab production facility for unlawful video surveillance of its employees. The court found that the company violated several GDPR articles, including those related to lawfulness of processing and consent, as there was no legal basis for the comprehensive surveillance. The court also ruled that issuing both a reprimand and a fine for the same violations did not constitute double punishment.

Full text

Help VG Hannover - 10 A 5144/23: Difference between revisions From GDPRhub Jump to:navigation, search VisualWikitext Revision as of 12:21, 9 September 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators173 edits Tag: Decisions [1.0] Latest revision as of 12:24, 9 September 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators173 edits Tag: Visual edit Line 112: Line 112: The controller appealed the DPA decision and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the prohibition against double punishment.The controller appealed the DPA decision and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the prohibition against double punishment. === Holding ====== Holding === The court dismissed the appeal and upheld the DPA decision. It held that the controller had violated Articles 5(1)(a), 5(1)(e), 6(1), and 30 GDPR. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of a GDPR violation but does not serve a punitive purpose.The court dismissed the appeal and upheld the DPA decision. It held that the controller had violated [[Article 5 GDPR|Articles 5(1)(a)]], [[Article 5 GDPR|5(1)(e)]], [[Article 6 GDPR|6(1)]], and [[Article 30 GDPR|30 GDPR]]. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of a GDPR violation but does not serve a punitive purpose. The court concluded that there was no legal basis for the comprehensive surveillance of employees under [[Article 6 GDPR|Article 6(1) GDPR]]. As a result, the controller had also violated the principle of lawfulness. First, the court found that the processing could not be based on [[Article 6 GDPR|Article 6(1)(a) GDPR]]: the controller had not provided any evidence that the employees would have consented to the comprehensive surveillance.The court concluded that there was no legal basis for the comprehensive surveillance of employees under [[Article 6 GDPR|Article 6(1) GDPR]]. As a result, the controller had also violated the principle of lawfulness. First, the court found that the processing could not be based on [[Article 6 GDPR|Article 6(1)(a) GDPR]]: the controller had not provided any evidence that the employees would have consented to the comprehensive surveillance. Latest revision as of 12:24, 9 September 2026 VG Hannover - 10 A 5144/23 Court: VG Hannover (Germany) Jurisdiction: Germany Relevant Law: Article 5(1)(a) GDPR Article 5(1)(e) GDPR Article 6(1)(a) GDPR Article 6(1)(f) GDPR Article 30(1) GDPR Decided: 07.08.2026 Published: 09.09.2026 Parties: National Case Number/Name: 10 A 5144/23 European Case Law Identifier: Appeal from: Appeal to: Unknown Original Language(s): German Original Source: juris (in German) Initial Contributor: av A court upheld a reprimand and a fine of €8,000 issued to a doner kebab production facility for unlawful video surveillance of employees in both indoor and outdoor areas of the business premises, including staff break rooms. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. There were cameras outdoors in the parking lot, the goods receiving and shipping areas, production area, the office, and staff break rooms. The comprehensive surveillance of employees (the data subjects) was discovered during an inspection by the labour inspectorate in June 2022. The DPA started investigating the controller's processing operations after the labour inspectorate had informed it about the video surveillance. In September 2023, the DPA issued a decision where it reprimanded the controller for violations of the principle of lawfulness and storage limitation, lack of legal basis for the processing, and the obligation to maintain a record of processing activities. In addition, the DPA issued the controller a fine for the violations of the principles of lawfulness and storage limitation. The amount of the fine was reduced to €8,000 by a decision of the Local Court Hannover (Amtsgericht Hannover). The controller appealed the DPA decision and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the prohibition against double punishment. Holding The court dismissed the appeal and upheld the DPA decision. It held that the controller had violated Articles 5(1)(a), 5(1)(e), 6(1), and 30 GDPR. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of a GDPR violation but does not serve a punitive purpose. The court concluded that there was no legal basis for the comprehensive surveillance of employees under Article 6(1) GDPR. As a result, the controller had also violated the principle of lawfulness. First, the court found that the processing could not be based on Article 6(1)(a) GDPR: the controller had not provided any evidence that the employees would have consented to the comprehensive surveillance. Second, the court held that the controller could not rely on legitimate interests under Article 6(1)(f) GDPR either, as no balancing test between the controllers' interest to monitor its premises and the rights and freedoms of the data subjects had been conducted. In addition, the court pointed out that neither compliance with hygiene regulations nor the prevention of burglaries and vandalism could constitute legitimate interests in the present case. Regarding hygiene, the court pointed out that the controller was required to comply with hygiene provisions by law as a business that processes food of animal origin. There was also no factual evidence for crimes mentioned by the controller being a threat in the area. Furthermore, the court held that the controller had infringed the principle of storage limitation by storing the video surveillance footage for longer than necessary: some data had been stored for years. Finally, the court confirmed that the controller had also violated Article 30(1) GDPR as it had not provided a record of processing activities despite the DPA's repeated requests. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more detai

Entities