German Court Upholds GDPR Fine for Unlawful Employee Video Surveillance
A doner kebab production facility in Germany was fined after conducting extensive video surveillance of its employees without a valid legal basis under GDPR, violating the principles of lawfulness, fairness, and storage limitation. This case illustrates that employers cannot deploy broad surveillance measures simply for operational convenience — each processing activity must have a clearly defined, documented legal basis. The ruling also confirmed that regulators may issue both a reprimand and a financial penalty without constituting double punishment, reinforcing the cumulative enforcement powers available to Data Protection Authorities. Organizations that fail to align surveillance practices with GDPR requirements risk significant financial and reputational consequences.
Tactical Insight
Immediate actions
- Conduct a Data Protection Impact Assessment (DPIA) before deploying any employee monitoring or surveillance system.
- Review all existing video surveillance installations to verify a documented legal basis (e.g., legitimate interest, legal obligation) exists for each camera and its retention period.
Policy & governance improvements
- Establish a clear internal policy defining permissible surveillance scope, retention limits, and employee notification requirements aligned with GDPR Articles 5 and 6.
- Appoint or consult a Data Protection Officer (DPO) to review and approve any new employee monitoring initiatives before deployment.
- Implement a regular audit schedule to reassess the necessity and proportionality of all ongoing surveillance measures.
Employee & management awareness
- Train HR and operations managers on GDPR obligations specific to workplace monitoring so they can identify non-compliant practices early.
- Ensure employees are informed of any lawful surveillance through transparent privacy notices as required by GDPR Articles 13 and 14.