Court case 42 K 73/25 – Court Ruling (Germany, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court supported a swimming pool operator's decision to implement identity checks and video surveillance due to safety concerns. The court ruled that these measures were necessary to protect visitors from potential harm. This case emphasizes the need for businesses to take safety seriously while adhering to privacy laws.
What happened
The court approved the swimming pool operator's identity verification and video surveillance measures aimed at ensuring safety for visitors.
Who was affected
Swimmers aged 14 and older who were required to show photo ID and were monitored by video surveillance at the pools.
What the authority found
The court found that the identity checks and video surveillance were necessary for public safety and complied with GDPR.
Why this matters
This decision indicates that safety measures can be legally implemented in public spaces. Operators should evaluate their security protocols to ensure they meet legal standards.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The controller ran 29 outdoor swimming pools in Berlin. In summer 2023, the controller introduced expanded identity verification checks and video surveillance measures due to safety concerns, such as aggressive behaviour and verbal and physical attacks by potential customers (the data subjects). Swimmers aged 14 and older were only granted access to the outdoor pools upon presentation of a photo ID, and video surveillance was implemented in the entry and exit areas. The video footage was stored for 72 hours. The DPA issued the controller a reprimand in August 2025. It held that the identity checks and the video surveillance were not necessary to fulfil the controller’s duties set forth in national law or ensure safety at the swimming pools and found a violation of Article 5(1)(a) GDPR. The controller appealed the DPA decision in September 2025. The court annulled the DPA decision and held that the identity verification checks and video surveillance had been necessary for the performance of a task carried out in the public interest within the meaning of Article 6(1)(e) GDPR. First, the court pointed out that the processing operations must serve objectives in the public interest in order to be lawful under Article 6(1)(e) GDPR. The aim of both measures was to prevent criminal offences, restore safety at the outdoor swimming pools for swimmers and staff members, and to protect the lives, health, and freedom of these individuals. This requirement was therefore fulfilled. Second, the court held that the criterion of necessity was also satisfied regarding both processing operations. According to the court, there did not appear to be a less intrusive measure that would interfere less with the fundamental rights of the data subjects and improve safety at the pools just as effectively than requiring swimmers to present a photo ID upon entry. Similarly, video surveillance was deemed the only viable option to ensure safety in the exit and entry areas, where the staff were e
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 42 K 73/25 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 42 K 73/25 - Germany (2026). Retrieved from cookiefines.eu
Last updated: