[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0fBn8gXwVYirtU4opFkMMry3moZI8BTuQV9oqfAXSxg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":20,"created_at":21,"published_at":22,"article":23,"tags":27,"podcasts":40},"00151760-c5c5-438d-8d9c-d9b375224a80","german-court-upholds-gdpr-fine-for-unlawful-employee-video-surveillance","5f76113b-c7e3-4007-8424-b1510da48627","German Court Upholds GDPR Fine for Unlawful Employee Video Surveillance","A doner kebab production facility in Germany was fined after conducting extensive video surveillance of its employees without a valid legal basis under GDPR, violating the principles of lawfulness, fairness, and storage limitation. This case illustrates that employers cannot deploy broad surveillance measures simply for operational convenience — each processing activity must have a clearly defined, documented legal basis. The ruling also confirmed that regulators may issue both a reprimand and a financial penalty without constituting double punishment, reinforcing the cumulative enforcement powers available to Data Protection Authorities. Organizations that fail to align surveillance practices with GDPR requirements risk significant financial and reputational consequences.","**Immediate actions:**\n- Conduct a Data Protection Impact Assessment (DPIA) before deploying any employee monitoring or surveillance system.\n- Review all existing video surveillance installations to verify a documented legal basis (e.g., legitimate interest, legal obligation) exists for each camera and its retention period.\n\n**Policy & governance improvements:**\n- Establish a clear internal policy defining permissible surveillance scope, retention limits, and employee notification requirements aligned with GDPR Articles 5 and 6.\n- Appoint or consult a Data Protection Officer (DPO) to review and approve any new employee monitoring initiatives before deployment.\n- Implement a regular audit schedule to reassess the necessity and proportionality of all ongoing surveillance measures.\n\n**Employee & management awareness:**\n- Train HR and operations managers on GDPR obligations specific to workplace monitoring so they can identify non-compliant practices early.\n- Ensure employees are informed of any lawful surveillance through transparent privacy notices as required by GDPR Articles 13 and 14.",[12,13,14,15,16,17,18,19],"GDPR Article 5 – Principles of lawful processing and storage limitation","GDPR Article 6 – Lawfulness of processing","GDPR Article 13\u002F14 – Transparency and information obligations","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST SP 800-53 IR-9 \u002F PT-2 – Privacy and data minimization controls","CIS Control 3 – Data Protection","ISO\u002FIEC 27001 Annex A.6.4 – Disciplinary process and monitoring","ITIL Service Design – Information security and privacy policy management","published","2026-09-15T18:20:25.016428+00:00","2026-09-15T18:20:24.885+00:00",{"id":7,"url":24,"slug":25,"title":26},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=VG_Hannover_-_10_A_5144\u002F23&diff=53043&oldid=52987","vg-hannover-10-a-5144-23-058d88","VG Hannover - 10 A 5144\u002F23",[28,34],{"id":29,"name":30,"slug":31,"description":32,"color":33},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":35,"name":36,"slug":37,"description":38,"color":39},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]