Court case 42 K 73/25 – Court Ruling (Germany, 2026)

The controller ran 29 outdoor swimming pools in Berlin. In summer 2023, the controller introduced expanded identity verification checks and video surveillance measures due to safety concerns, such as aggressive behaviour and verbal and physical attacks by potential customers (the data subjects). Swimmers aged 14 and older were only granted access to the outdoor pools upon presentation of a photo ID, and video surveillance was implemented in the entry and exit areas. The video footage was stored for 72 hours. The DPA issued the controller a reprimand in August 2025. It held that the identity checks and the video surveillance were not necessary to fulfil the controller’s duties set forth in national law or ensure safety at the swimming pools and found a violation of Article 5(1)(a) GDPR. The controller appealed the DPA decision in September 2025. The court annulled the DPA decision and held that the identity verification checks and video surveillance had been necessary for the performance of a task carried out in the public interest within the meaning of Article 6(1)(e) GDPR. First, the court pointed out that the processing operations must serve objectives in the public interest in order to be lawful under Article 6(1)(e) GDPR. The aim of both measures was to prevent criminal offences, restore safety at the outdoor swimming pools for swimmers and staff members, and to protect the lives, health, and freedom of these individuals. This requirement was therefore fulfilled. Second, the court held that the criterion of necessity was also satisfied regarding both processing operations. According to the court, there did not appear to be a less intrusive measure that would interfere less with the fundamental rights of the data subjects and improve safety at the pools just as effectively than requiring swimmers to present a photo ID upon entry. Similarly, video surveillance was deemed the only viable option to ensure safety in the exit and entry areas, where the staff were exposed to considerable danger of assaults and threats. The court deemed the restriction to the right of informational self-determination to be relatively minor, since video surveillance was only used in four pools where the risk was high, did not cover the entire pool area, and resulted in recordings that were only stored for 72 hours.