Data Subject versus B. GmbH (a private security company responsible for security operations at a shopping centre in Bavaria) – Court Ruling (Germany, 2025)

The controller is a private security company providing security services at a shopping centre in Bavaria. In January 2021, a security guard working for the controller asked multiple times the data subject to leave the seating area owned by the controller. The situation became tense, to the point that the police was called. In 26 July 2021, the data subject lodged a complaint with the Data Protection Authority (Bavarian Data Protection Authority - LfD Bayern) against the controller, alleging that the security guard started recording him without his consent with his body-worn camera. According to the data subject this constituted unlawful processing of personal data under the GDPR. The controller explained that the guard activated the camera only after the data subject repeatedly refused to leave a restricted seating area, that the recording was communicated to the data subject, that a red indicator light signaled recording, and that the footage was deleted once its purpose of identifying the individual for possible civil action had been fulfilled. The DPA held that it was no longer possible to clarify whether the data subject had been aggressive or whether the bodycam had only been activated after the announcement. The DPA therefore assumed that the security guard had acted in accordance with its operational policy. It decided to rejected the complaint, finding that the recording was justified under Article 6(1)(f) GDPR as necessary for the controller’s legitimate interests of protecting property and ensuring safety. The data subject then appealed the decision of the DPA before the court of first instance (Administrative Court of Ansbach - VG Ansbach). The court upheld the DPA’s decision, holding that the DPA had sufficiently investigated the matter and properly exercised its discretion under Articles 57 and 58 GDPR. It found no violation of the GDPR, noting that the processing was proportionate and limited to a specific incident. The data subject appealed again the decision of the court of first instance before the court of appeal (Administrative Court of Munich - VGH München) arguing that he was not informed about the recording, that the DPA’s investigation had been inadequate and that corrective action should have been ordered despite uncertainty over the lawfulness of the recording. The Court dismissed the appeal, finding no basis to reopen the case or question the DPA’s assessment. The Court held that the use of a body-worn camera by the controller's private security guard was lawful under Article 6(1)(f) GDPR, as it served legitimate interests in protecting property, maintaining order, and ensuring staff safety. The recording was held to be proportionate, limited to a specific instance of confrontation, and was accompanied by visible notice through an activated red light. The Court further held that the DPA had lawfully exercised its discretion under Articles 57 and 58 GDPR, having adequately investigated the complaint and finding that no infringement occurred. The DPA was not required to impose corrective measures where a violation could not be established. Accordingly, the appeal was dismissed, and no procedural or investigative failings were found.