Court case 10 A 5144/23 – Court Ruling (Germany, 2026)

The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the parking lot, the goods receiving and shipping areas, production area, the office, and staff break rooms. The monitoring of employees (the data subjects) was discovered during a labour inspectorate inspection in June 2022, which informed the DPA. In September 2023, the DPA reprimanded and fined the controller for violations of the principle of lawfulness and storage limitation, lack of legal basis for the processing, and the obligation to maintain a record of processing activities. The DPA issued two separate decisions against the controller – one where it fined the controller, and a separate decision where it issued the controller a reprimand. Upon the controller's appeal regarding the decision issuing the fine, the amount of the fine was reduced to €8,000 by a decision of the Local Court Hannover (Amtsgericht Hannover). The controller appealed the reprimand decision to the Administrative Court Hannover (Verwaltungsgericht Hannover) and argued that the employees had given their consent to the surveillance. It also stated that the surveillance was necessary to ensure compliance with hygiene regulations and that the outdoor areas were monitored to prevent break-ins, theft, and vandalism. According to the controller, both a reprimand and a fine for the same violations infringed the general prohibition against double punishment. The court dismissed the appeal and upheld the reprimand issued to the controller. It held that the controller had violated Articles 5(1)(a), 5(1)(e), 6(1), and 30 GDPR. Moreover, the court stated that issuing a reprimand and a fine for the same GDPR violations did not constitute a double punishment, as a reprimand does not fall under the criminal law definition of a sanction. The court pointed out that a reprimand is an administrative measure that involves a finding of a GDPR violation but does not serve a punitive purpose. Regarding the lawfulness of the processing, the court examined whether consent or legitimate interest could be relied upon. For consent, the court found that the processing could not be based on Article 6(1)(a) GDPR: the controller had not provided any evidence that the employees would have consented to the processing. The controller could not rely on legitimate interests under Article 6(1)(f) GDPR either, as no balancing test had been conducted. In addition, the court pointed out that neither compliance with hygiene regulations nor the prevention of burglaries and vandalism could constitute legitimate interests in the present case. Regarding hygiene, the court pointed out that the controller was required to comply with hygiene provisions by law as a business that processes food of animal origin. There was also no factual evidence for crimes mentioned by the controller being a threat in the area. Furthermore, the court held that the controller had infringed the principle of storage limitation by storing the video surveillance footage for longer than necessary: some data had been stored for years. Finally, the court confirmed that the controller had also violated Article 30(1) GDPR as it had not provided a record of processing activities despite the DPA's repeated requests.