Court case 10 A 5144/23 – Court Ruling (Germany, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled against a kebab shop owner who installed cameras throughout his business without proper justification. The court found that the surveillance violated privacy laws because there was no valid reason for monitoring employees in such a manner. This case highlights the need for businesses to respect employee privacy.
What happened
The court reprimanded the kebab shop owner for unlawfully monitoring employees with video cameras.
Who was affected
Employees of the kebab shop who were monitored by the installed cameras.
What the authority found
The court decided that the owner lacked a valid legal basis for the extensive surveillance, violating privacy laws.
Why this matters
This ruling serves as a reminder for businesses to ensure that any employee monitoring is justified and compliant with privacy regulations.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the parking lot, the goods receiving and shipping areas, production area, the office, and staff break rooms. The monitoring of employees (the data subjects) was discovered during a labour inspectorate inspection in June 2022, which informed the DPA. In September 2023, the DPA reprimanded and fined the controller for violations of the principle of lawfulness and storage limitation, lack of legal basis for the processing, and the obligation to maintain a record of processing activities. The DPA issued two separate decisions against the controller – one where it fined the controller, and a separate decision where it issued the controller a reprimand. Upon the controller's appeal regarding the decision issuing the fine, the amount of the fine was reduced to €8,000 by a decision of the Local Court Hannover (Amtsgericht Hannover). The controller appealed the reprimand decision to the Administrative Court Hannover (Verwaltungsgericht Hannover) and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the general prohibition against double punishment. The court dismissed the appeal and upheld the reprimand issued to the controller. It held that the controller had violated Articles 5(1)(a), 5(1)(e), 6(1), and 30 GDPR. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 10 A 5144/23 in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 10 A 5144/23 - Germany (2026). Retrieved from cookiefines.eu
Last updated: