Data Protection Authority of Lower Saxony – Court Ruling (Germany, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A German court ruled that a gas station must shorten its video storage time. The station kept footage for six to eight weeks, but the court said this was too long and violated privacy rights. This decision highlights the importance of balancing security needs with privacy concerns.
What happened
A gas station was ordered to reduce the storage time of its video surveillance recordings.
Who was affected
People visiting the self-service petrol station and retail shop who were recorded by the surveillance cameras.
What the authority found
The court decided that the gas station's long-term storage of video footage without a clear need violated people's privacy rights.
Why this matters
This case emphasizes that businesses must carefully consider how long they keep surveillance footage and ensure it's only stored as long as necessary. It serves as a reminder for companies to regularly review their data retention policies to protect customer privacy.
GDPR Articles Cited
National Law Articles
The controller operated a 24-hour self-service petrol station with a retail shop, both accessible by everyone. Following a complaint, the DPA requested the plaintiff to provide information about the video surveillance. In their response, the controller pointed out, that they had installed cameras in the shop and outdoor, including the self-service gas station area. According to the controller, the self-service gas station property is damaged five to six times a year. It also happened that customers forgot the fuel nozzle in the vehicle and drove off. The video surveillance recordings was stored on a hard drive for about six to eight weeks. The controller added that they determined the annual damage in the gas station operation in the amount of € 10.000 – including vandalism and break-ins. The video recordings had a crucial function with regard to these offences. A storage period reduced to 72 hours, as asked by the original complainant, was unreasonably short. The controller also argue that compensation for damages would be made considerably more difficult by a 72 hours storage period. In addition, according to the controller, the GDPR Regulation does not provide for any rigid deletion periods. The DPA ordered the plaintiff to limit the storage period of the video recordings. In the event of non-implementation, incomplete implementation or late implementation, a penalty payment was threatened. The DPA further explained, that it not objected Article 6(1)(f) GDPR as legal basis for the video surveillance. However, any video surveillance encroaches on the fundamental right of natural persons. Video surveillance measures have a high degree of intervention intensity. Numerous people are included in the surveillance action who are not related to specific misconduct. Video recordings should therefore be deleted immediately if they are no longer necessary to achieve the purposes for which they were collected. Although there are no rigid retention limits stated in the GDPR,
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Data Protection Authority of Lower Saxony in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Data Protection Authority of Lower Saxony - Germany (2023). Retrieved from cookiefines.eu
Last updated: