Court case 42 K 51.25 – Court Ruling (Germany, 2026)

The property management company of a high-rise building (the controller) had a video surveillance system installed at the entrances of the building in 2021. The installation was approved by the homeowners' association. The footage was stored for 72 hours, and there was no live monitoring. Signs indicating video surveillance were posted at both entrances. The owner of an apartment in the building (a data subject) filed a complaint with the DPA in July 2023. The controller argued that the surveillance was intended to prevent and detect unauthorised access to the building and criminal offences. It also stated that there had been repeated incidents of vandalism and property damage prior to the installation of the cameras. The DPA issued it's final notice in April 2025 and held that no violation of the GDPR could be established. It considered the video surveillance necessary to protect the legitimate interests of data subjects - namely, the protection of property against damage and vandalism. The data subject appealed the DPA decision in April 2025. He argued that there was no particular threat that would justify the installation of a video surveillance system. According to the data subject, an on-site investigation carried out by the Berlin police supported this view. The court dismissed the data subject's appeal. It held that the DPA had fulfilled its obligation under Article 57(1)(f) GDPR and investigated the complaint to an appropriate extent. In addition, the court held that the video surveillance was lawful under Article 6(1)(f) GDPR. The court came to the conclusion that the controller's aim to protect property against vandalism and prevent criminal offenses constituted a legitimate interest within the meaning of Article 6(1)(f) GDPR. It referred to previous jurisprudence and pointed out that video surveillance could be only be justified for such purposes if there is a threat that goes beyond the general risks of daily life. This requirement was fulfilled in the present case, as there had been incidents of vandalism, property damage, and threats. Furthermore, the court held that there were no alternative security measures available that would interfere less with the rights of data subjects and be equally suitable for achieving the purposes of the video surveillance. According to the court, hiring a security service to permanently monitor the entrances to the building would not constitute a milder measure from a data minimisation perspective, since the security guards would have to verify the access authorisations of everyone entering the building and ask them why they wish to enter. Finally, the court argued that the legitimate interests of the property management company ultimately outweighed the interests and fundamental rights and freedoms of the data subjects. The court considered the impact on the individuals being filmed to be minimal: the video surveillance was limited to the entrance areas, the data subjects had been informed of the surveillance and the footage was deleted after 72 hours.