Data Subject versus B. GmbH (a private security company responsible for security operations at a shopping centre in Bavaria) – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court in Bavaria ruled that a security guard acted lawfully when he recorded a visitor with a body camera after the visitor refused to leave a restricted area. The court found that the recording was necessary for the security company's legitimate interests, like protecting property. This decision highlights the balance between safety measures and privacy rights.
What happened
A security guard recorded a visitor with a body camera after the visitor repeatedly refused to leave a restricted area.
Who was affected
The visitor who was recorded by the security guard at the shopping centre.
What the authority found
The court upheld the DPA's decision, stating that the recording was justified under GDPR as necessary for the company's legitimate interests.
Why this matters
This ruling shows that security measures can sometimes justify recording individuals, which is important for companies that use surveillance. It emphasizes the need for businesses to understand the legal grounds for recording in public spaces.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The controller is a private security company providing security services at a shopping centre in Bavaria. In January 2021, a security guard working for the controller asked multiple times the data subject to leave the seating area owned by the controller. The situation became tense, to the point that the police was called. In 26 July 2021, the data subject lodged a complaint with the Data Protection Authority (Bavarian Data Protection Authority - LfD Bayern) against the controller, alleging that the security guard started recording him without his consent with his body-worn camera. According to the data subject this constituted unlawful processing of personal data under the GDPR. The controller explained that the guard activated the camera only after the data subject repeatedly refused to leave a restricted seating area, that the recording was communicated to the data subject, that a red indicator light signaled recording, and that the footage was deleted once its purpose of identifying the individual for possible civil action had been fulfilled. The DPA held that it was no longer possible to clarify whether the data subject had been aggressive or whether the bodycam had only been activated after the announcement. The DPA therefore assumed that the security guard had acted in accordance with its operational policy. It decided to rejected the complaint, finding that the recording was justified under Article 6(1)(f) GDPR as necessary for the controller’s legitimate interests of protecting property and ensuring safety. The data subject then appealed the decision of the DPA before the court of first instance (Administrative Court of Ansbach - VG Ansbach). The court upheld the DPA’s decision, holding that the DPA had sufficiently investigated the matter and properly exercised its discretion under Articles 57 and 58 GDPR. It found no violation of the GDPR, noting that the processing was proportionate and limited to a specific incident. The data subject appealed again
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Data Subject versus B. GmbH (a private security company responsible for security operations at a shopping centre in Bavaria) in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Data Subject versus B. GmbH (a private security company responsible for security operations at a shopping centre in Bavaria) - Germany (2025). Retrieved from cookiefines.eu
Last updated: