Data Protection Authority of Lower Saxony – Court Ruling (Germany, 2023)

The controller operated a 24-hour self-service petrol station with a retail shop, both accessible by everyone. Following a complaint, the DPA requested the plaintiff to provide information about the video surveillance. In their response, the controller pointed out, that they had installed cameras in the shop and outdoor, including the self-service gas station area. According to the controller, the self-service gas station property is damaged five to six times a year. It also happened that customers forgot the fuel nozzle in the vehicle and drove off. The video surveillance recordings was stored on a hard drive for about six to eight weeks. The controller added that they determined the annual damage in the gas station operation in the amount of € 10.000 – including vandalism and break-ins. The video recordings had a crucial function with regard to these offences. A storage period reduced to 72 hours, as asked by the original complainant, was unreasonably short. The controller also argue that compensation for damages would be made considerably more difficult by a 72 hours storage period. In addition, according to the controller, the GDPR Regulation does not provide for any rigid deletion periods. The DPA ordered the plaintiff to limit the storage period of the video recordings. In the event of non-implementation, incomplete implementation or late implementation, a penalty payment was threatened. The DPA further explained, that it not objected Article 6(1)(f) GDPR as legal basis for the video surveillance. However, any video surveillance encroaches on the fundamental right of natural persons. Video surveillance measures have a high degree of intervention intensity. Numerous people are included in the surveillance action who are not related to specific misconduct. Video recordings should therefore be deleted immediately if they are no longer necessary to achieve the purposes for which they were collected. Although there are no rigid retention limits stated in the GDPR, storage limits are based on the necessity of storage. A day or two should be sufficient to decide whether further storage of the video recordings is necessary. Taking into account the data protection principles of data minimization and storage limitation, deletion should take place regularly after 48 hours. Considering non-working hours at the weekend 72 hours are acceptable. As an exception, a longer storage period is permissible for absences on public holidays. The controller appealed against the order of the DPA. In the appeal, the controller repeated their previous submissions before the DPA. In particular, the DPA order violated the principle of certainty. The GDPR does not contain any information about the duration of data storage. The plaintiff took the view that § 4 Bundesdatenschutzgesetz (BDSG) is the legal basis for the video surveillance. The self-service petrol is a facility for maintaining public transport and thus an operation in the area of services of general interest, so that it is to be regarded as a public facility within the meaning of the BDSG. § 4 BDSG The Administrative Court of Hannover dismissed the lawsuit. The permissible purpose of video surveillance is to prevent and track criminal offenses, in particular vandalism and damage to property. For this purpose, the controller was entitled to collect and store images. However, it was not necessary to keep these records for six to eight weeks to achieve the purpose. It was easily possible to determine within 72 hours whether vandalism or damage occurred and, should this be the case, then to view the video material. If the video material then provides further information on a crime, a controller is entitled to store it for a longer period of time. The court also stressed how EDPB also generally assumes a permissible storage period of 72 hours. A storage period that goes beyond this is possible, but requires a necessity and a particular justification. With regard to the clarification of cases of vandalism and damage to property, the plaintiff has not succeeded in presenting a comprehensible reason why it should not be possible for them to report corresponding incidents within 72 hours. The decision of the data protection authority to limit the storage period was therefore legally not objectionable. The limitation of the retention period by the authority was based on Article 58(2)(f) GDPR. Accordingly, the supervisory authority can impose a temporary or permanent restriction on processing, including a ban. Contrary to what the controller believed, the order was not vague. In the disputed decision, it was pointed out that a longer storage period is permissible in the event of absences on public holidays. The DPA also explained that longer storage is possible in cases in which the recorded video is necessary to clarify cases of damage. Concerning the legal basis for the processing, video surveillance carried out by the controller and the storage of video recording were subject to the regulatory regime of the GDPR. Contrary to what the controller believed, they could not base the video surveillance and storage on § 4 BDSG. This provision is contrary to Union law insofar as it affects non-public bodies. Article 6(1)(e) GDPR and Article 6(3) GDPR only give the member states regulatory leeway to regulate video surveillance that is carried out in the context of a task that is in the public interest or in the exercise of official authority. § 4(1) BDSG, contrary to Union law, allows video surveillance for the exercise of domiciliary rights by non-public bodies.