Data Subject versus B. GmbH (a private security company responsible for security operations at a shopping centre in Bavaria) – Court Ruling (Germany, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The controller is a private security company providing security services at a shopping centre in Bavaria. In January 2021, a security guard working for the controller asked multiple times the data subject to leave the seating area owned by the controller. The situation became tense, to the point that the police was called. In 26 July 2021, the data subject lodged a complaint with the Data Protection Authority (Bavarian Data Protection Authority - LfD Bayern) against the controller, alleging that the security guard started recording him without his consent with his body-worn camera. According to the data subject this constituted unlawful processing of personal data under the GDPR. The controller explained that the guard activated the camera only after the data subject repeatedly refused to leave a restricted seating area, that the recording was communicated to the data subject, that a red indicator light signaled recording, and that the footage was deleted once its purpose of identifying the individual for possible civil action had been fulfilled. The DPA held that it was no longer possible to clarify whether the data subject had been aggressive or whether the bodycam had only been activated after the announcement. The DPA therefore assumed that the security guard had acted in accordance with its operational policy. It decided to rejected the complaint, finding that the recording was justified under Article 6(1)(f) GDPR as necessary for the controller’s legitimate interests of protecting property and ensuring safety. The data subject then appealed the decision of the DPA before the court of first instance (Administrative Court of Ansbach - VG Ansbach). The court upheld the DPA’s decision, holding that the DPA had sufficiently investigated the matter and properly exercised its discretion under Articles 57 and 58 GDPR. It found no violation of the GDPR, noting that the processing was proportionate and limited to a specific incident. The data subject appealed again
GDPR Articles Cited
The controller is a private security company providing security services at a shopping centre in Bavaria. In January 2021, a security guard working for the controller asked multiple times the data subject to leave the seating area owned by the controller. The situation became tense, to the point that the police was called. In 26 July 2021, the data subject lodged a complaint with the Data Protection Authority (Bavarian Data Protection Authority - LfD Bayern) against the controller, alleging that the security guard started recording him without his consent with his body-worn camera. According to the data subject this constituted unlawful processing of personal data under the GDPR. The controller explained that the guard activated the camera only after the data subject repeatedly refused to leave a restricted seating area, that the recording was communicated to the data subject, that a red indicator light signaled recording, and that the footage was deleted once its purpose of identifying the individual for possible civil action had been fulfilled. The DPA held that it was no longer possible to clarify whether the data subject had been aggressive or whether the bodycam had only been activated after the announcement. The DPA therefore assumed that the security guard had acted in accordance with its operational policy. It decided to rejected the complaint, finding that the recording was justified under Article 6(1)(f) GDPR as necessary for the controller’s legitimate interests of protecting property and ensuring safety. The data subject then appealed the decision of the DPA before the court of first instance (Administrative Court of Ansbach - VG Ansbach). The court upheld the DPA’s decision, holding that the DPA had sufficiently investigated the matter and properly exercised its discretion under Articles 57 and 58 GDPR. It found no violation of the GDPR, noting that the processing was proportionate and limited to a specific incident. The data subject appealed again
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Data Subject versus B. GmbH (a private security company responsible for security operations at a shopping centre in Bavaria) in DE
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Data Subject versus B. GmbH (a private security company responsible for security operations at a shopping centre in Bavaria) - Germany (2025). Retrieved from cookiefines.eu
Last updated: