VG Berlin: DPA correctly found residential video surveillance for property protection

Court: Berlin Administrative Court, 42nd Chamber Date of Decision: April 20, 2026 Case Number: 42 K 51.25 ECLI: ECLI:DE:VGBE:2026:0420.42K51.25.00 Document Type: Judgement Source: Legal Provisions: Art. 6(1), para 1, subparagraph (f) of the GDPR, Art. 57(1), subparagraph (f) of the GDPR, Art. 77 of the GDPR, Art. 6 (1), para 1, subparagraph (f) of Regulation (EU) 2016/679, Art. 57(1)(f) of Regulation (EU) 2016/679 ... more Operative Part The lawsuit is dismissed. The plaintiff shall bear the costs of the proceedings. The judgement is provisionally enforceable with respect to costs. The plaintiff may avert enforcement by providing security in the amount of 110% of the amount enforceable pursuant to the judgment, unless the defendant provides security prior to enforcement in the amount of 110% of the respective amount to be enforced. Facts of the Case 1 The plaintiff challenges the handling of a complaint by the Berlin Commissioner for Data Protection and Freedom of Information.

The plaintiff is the owner of an apartment in the high-rise building W ... in Berlin. Following a corresponding resolution by the condominium owners’ association, the property management company (R ... ) had a video surveillance system installed at the front and rear entrances of the building in 2021. The two cameras film the respective building hallways. The recordings are stored for 72 hours; there is no live monitoring. Signs indicating video surveillance are posted at both entrances.

On July 7, 2023, the plaintiff filed a lawsuit against the defendant alleging a data protection violation. In support of his claim, he argued that there was no threat that would justify the use of video surveillance technology. Furthermore, he stated that the warning signs had not been posted until video surveillance had already been in operation for some time.

The property management company, which the defendant had requested information from, stated in a letter from its external data protection officer dated October 23, 2023, that video surveillance was conducted to enforce property rights, in particular to prevent and detect the entry of unauthorized persons. Furthermore, the aim was to prevent and detect criminal offenses. A security risk existed. There were regular instances of unauthorized entry into the building. Teenagers would gain access and use the top floors for parties. There were repeated incidents of vandalism and property damage. Although there was no detailed documentation of the incidents, it was evident - Page 1 of 6 - that prior to the installation of the cameras, the glass panes of the courtyard entrance door and in the entrance area were damaged almost weekly. This has been significantly reduced. The Berlin Police also conducted an on-site consultation on November 10, 2022. They stated that the overall crime rate is average. The However, the area is in some places run-down and populated by homeless people and individuals from the drug scene. Other measures to address the problem have been discussed, partially tested, but deemed ineffective.

In a final notice dated April 7, 2025, the defendant determined that no violation of data protection law could be established. The use of the video surveillance system is permissible to safeguard the legitimate interests of the data subjects (protection of property against damage and vandalism). The data subjects’ interests worthy of protection did not outweigh this, since there was no extensive Surveillance of the interior of the property or of the outdoor areas on the premises. There is therefore no comprehensive surveillance of the social lives of the data subjects. The video surveillance is limited to the entrance areas of the property that are specifically at risk. The video surveillance has been made transparent through informational signs.

The plaintiff filed a lawsuit on April 29, 2025. He argues that there is no threat that would justify the installation of the video surveillance system. Even the statement by the Berlin Police following the on-site inspection on November 10, 2022 did not indicate any particular threat. Nor does the video surveillance have a deterrent effect. Unauthorized persons entering the building cannot be prevented, nor can any person be identified who later causes damage inside the building.

The plaintiff moves, in essence, 8 that the defendant be ordered—upon revocation of the final notice dated April 7, 2025— to issue a new decision, in accordance with the Court’s legal opinion, regarding data protection measures against R … concerning the video surveillance system in the residential building W ... 9.

It contests the lawsuit and states that it had sufficiently investigated the plaintiff’s complaint and requested a statement from the controller. As a result, it concluded that the video surveillance was not objectionable under data protection law.

The legal basis for the defendant’s final notice is Art. 57(1)(f) of the DSG- Regulation in conjunction with Art. 77(1) of the GDPR. If a data subject files a data protection complaint, the competent supervisory authority must, pursuant to Art. 57(1)(f) GDPR, address the complaint, investigate the subject matter of the complaint to an appropriate extent, and inform the complainant within a reasonable timeframe of the progress and outcome of the investigation. If the complainant’s submission provides indications of a violation of data protection regulations, the supervisory authority must investigate this and take measures to clarify the facts of the matter. The extent of the supervisory authority’s duty to investigate depends on the individual case; it must be carried out with due diligence, taking into account, in particular, the severity of the interference with the rights of the data subjects as well as the resources and capabilities of the supervisory authority (see Körffer, in: Paal/Pauly, GDPR BDSG, 4th ed. 2026, Art. 77 GDPR, para. 5). This also follows from Recital 141, sentence 2 of the GDPR, according to which the investigation, subject to Court review, should go as far as is appropriate in the individual case. The decisions of the supervisory authority are subject to full substantive judicial review, although with regard to Art. 58(2) GDPR (powers to take remedial action) a margin of discretion that can only be reviewed to ensure compliance with its limits (see CJEU, Judgement of October 4, 2024—C-621/22, juris, para. 37, 46; CJEU, Judgement of September 26, 2024—C-768/21, juris, para. 49; CJEU, Judgement of December 7, 2023—C-26/22, juris, para. 53, 70). This gives rise to a two-step review. First, it must be determined whether the supervisory authority has conducted a reasonable examination to determine whether there has been a violation of the General Data Protection Regulation. In the the event that a violation is found, the plaintiff is entitled to a decision—free from errors of discretion— regarding the defendant’s supervisory intervention (VGH Munich, order of September 12, 2025 – 5 ZB 23.1778, juris, para. 14 with further references).

In handling the plaintiff’s complaint, the defendant fulfilled its duty under Art. 57(1)(f) GDPR and, in particular, conducted a sufficient investigation. The Court shares the defendant’s view that no violation of the provisions of the General Data Protection Regulation can be established.

It is undisputed among the parties that the video recordings constitute personal data within the meaning of Art. 4 No. 1 of the GDPR, which are processed within the meaning of Art. 4 No. 2 of the GDPR, is rightly undisputed between the parties (see BVerwG, judgement of March 27, 2019 – 6 C 2/18, juris, para. 43; regarding the classification of video recordings as personal data, see also OVG Berlin-Brandenburg, judgement of May 13, 2025 – 12 B 14/23, juris, para. 36 et seq.). Contrary to the plaintiff’s view, however, the processing is lawful. The legal basis is Art. 6(1), first sentence, subparagraph (f) of the GDPR. According to this provision, the processing - Page 3 of 6 - is lawful only if it is necessary to safeguard the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the data subject that require the protection of personal data, in particular where the data subject is a child. Video surveillance is lawful in light of this.

First, video surveillance is carried out to safeguard legitimate interests. The concept of legitimate interest is, in principle, to be understood broadly. This includes not only legal interests, but also factual, economic, or non-material interests (Buchner/Petri, in: Kühling/Buchner, GDPR BDSG, 4th ed. 2024, Art. 6 GDPR, margin note 146a). A legitimate interest also exists when the owner of the premises wishes—as in this case—to protect against theft or vandalism (see Guidance on Video Surveillance by Non-Public Bodies issued by the Data Protection Conference — DSK — dated July 17, 2020, Section 2.2.1.). However, video surveillance for protection against vandalism, as invoked by the property management, can only be objectively justified if there is a threat that goes beyond the general risks of daily life. Such a threat can only be derived from factual findings; subjective fears or a feeling of insecurity are not sufficient (Hanover Administrative Court, judgement of October 10, 2023 – 10 A 3472/20, juris, para. 50). Based on this, there is a legitimate interest, as the property management company has demonstrated the existence of a corresponding risk. In a letter dated October 23, 2023, from the property management company’s external data protection officer, it is stated that the majority of homeowners had decided to install a video surveillance system because there had been regular instances of unauthorized entry into the building. Teenagers had gained access and used the top floors for parties. In addition, there had been incidents of vandalism, property damage, and threats. This situation is confirmed by the statement from the Berlin Police following an on-site visit on November 10, 2022. The main problems cited there are “teenagers partying on the 24th-floor balcony or the roof, along with the resulting mess and noise,” as well as “homeless people in the outdoor areas, in the recesses of the building and in the emergency stairwell, usually associated with alcohol and/or drug use,” and “vandalism through graffiti.” The fact that the general crime- situation regarding the building and a 100-meter radius around it is described by the Berlin Police as “moderately affected” and that, in their assessment, no particular risk situation is apparent, does not preclude the assumption of a risk situation. For the circumstances mentioned above alone support the assumption of a risk that justifies the installation of a video surveillance system, especially since the building, due to its location, serves as a gathering place and thoroughfare for many different groups of people, and its size makes social control difficult. According to the statement from the Berlin Police, the number of subleases is no longer transparent. This results in varying identification and responsibility for the living space, more difficult social control, and higher turnover of people in the building.

The necessity of video surveillance must also be affirmed. The prerequisite for this is that no less intrusive, equally effective means is available to achieve the interests of the data controller (Buchner/Petri). 19 The necessity of video surveillance must also be affirmed. A prerequisite for this is that no less intrusive, equally effective means is available to achieve the interests of the controller (Buchner/Petri, in: Kühling/Buchner, GDPR BDSG, 4th edition 2024, Art. 6 GDPR, para. 147c). Before installing a video surveillance system, the controller must consider alternative (security) measures - Page 4 of 6 - . If these measures interfere less with the rights of the data subjects and are equally suitable for achieving the purposes of the Surveillance, they must be given priority (Guidance on Video Surveillance by Non-Public Bodies issued by the Data Protection Conference—DSK—dated July 17, 2020, Section 2.2.2.). The property management company has complied with these requirements. Less intrusive, equally effective measures cannot be taken . In a letter from the property management company’s external data protection officer dated October 23, 2023, it is stated in this regard that security patrols were introduced during the evening hours. However, this proved ineffective because the security patrols only conducted sporadic checks. Permanent staffing of the entrance area with a concierge service was considered but ultimately rejected. There are no objections to this. It remains an open question whether this is the case simply because, according to the property management company, a concierge service would entail considerable costs amounting to approximately 200,000.00 euros per year (criticized, for example, by Buchner/Petri, in: Kühling/Buchner, GDPR BDSG, 4th ed. 2024, Art. 6 GDPR, para. 147c, according to which necessity cannot be justified solely on the grounds that, from the most economically sensible alternative from the controller’s perspective). This is because an argument against using a concierge service is that, from a data protection law perspective (principle of data minimisation, Art. 5(1)(c) GDPR), because the data collection would be more extensive than when using video surveillance. The property management company correctly points out that the concierge would have to verify the access authorizations of all persons entering the building and, in doing so, would also have to ask why they are entering the building.

Ultimately, the property management company’s legitimate interests in video surveillance outweigh the interests, as well as the fundamental rights and freedoms, of the data subjects affected by the video surveillance. The starting point for this balancing test is, on the one hand, the effects that data processing has on the data subject and, on the other hand, the interests of the controller. In this context, the nature, content, and significance of the data in question must be assessed in light of the purpose pursued by the data processing (Buchner/Petri, in: Kühling/Buchner, GDPR BDSG, 4th ed. 2024, Art. 6 GDPR, para. 149). According to these criteria, the interests of the property management company prevail. It pursues significant security interests. The impact on the individuals being filmed, on the other hand, is minimal. There is no comprehensive Surveillance of the interior and exterior areas of the building; video surveillance is limited to the entrance areas. There is no surveillance of the social lives of the building’s residents—as the defendant correctly points out—especially since the recordings are deleted after 72 hours. Signs indicating video surveillance (see the Guidance on Video Surveillance by Non-Public Entities issued by the Data Protection Conference—DSK—on July 17, 2020, Section 3.3) are in place; the property management company had also informed the residents of the building prior to the installation of the video surveillance system.