German Court Upholds GDPR Lawful Basis for Public Pool ID and Video Surveillance
A Berlin administrative court overturned a DPA reprimand against a public swimming pool operator, affirming that requiring photo ID and operating entry/exit video surveillance were lawful under GDPR Article 6(1)(e) — the public interest basis — rather than a violation of Article 5(1)(a). This case highlights how organizations can face regulatory action when the legal basis for data processing activities is not clearly documented and communicated upfront. It underscores that not all data collection constitutes a GDPR violation; the proportionality and necessity of the measure in context are critical factors. Organizations must proactively establish and document the correct lawful basis for each processing activity to withstand regulatory scrutiny, rather than reacting after a complaint or reprimand.
Tactical Insight
Immediate actions
- Conduct a rapid audit of all existing data processing activities to verify that the correct GDPR lawful basis (e.g., consent, public interest, legitimate interest) is documented for each.
- Post clear, accessible privacy notices at points of data collection (e.g., entry gates, camera zones) explaining the purpose and legal basis for processing.
Long-term improvements
- Maintain a comprehensive Record of Processing Activities (RoPA) as required by GDPR Article 30, updated whenever new processing activities are introduced.
- Perform Data Protection Impact Assessments (DPIAs) for all high-risk processing activities, including video surveillance, before deployment.
- Engage a qualified Data Protection Officer (DPO) or legal counsel to review processing activities against applicable national and EU legal frameworks on an annual basis.
Regulatory engagement measures
- Establish a proactive communication channel with your local DPA to seek informal guidance before implementing new surveillance or ID-verification measures.
- Develop and rehearse a DPA inquiry response procedure so that documented justifications can be submitted promptly and accurately if a reprimand or investigation arises.