VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance

Hanover Administrative Court, 10th Chamber, Judgement of August 7, 2026, Case No.: 10 A 5144/23 EUV 2016/679 para 58(2)(b), EUV 2016/679 § 58(2)(i), EUV 2016/679 § 83(2), BrandSchG SL § 26, The plaintiff challenges, among other things, the defendant’s data protection warning regarding video surveillance at the plaintiff’s facility. The plaintiff is an enterprise that produces meat for kebabs. During an inspection by the Braunschweig Labor Inspectorate on June 17, 2022, it was noted that images from several surveillance cameras were visible in the office of the plaintiff’s managing director. The Trade Supervisory Office informed the defendant of this, and the defendant, as the supervisory authority for data protection, initiated an investigation and requested the plaintiff to submit comments in response to a questionnaire. The plaintiff refused to comment, invoking the right to remain silent because answering the questions could expose it to the risk of criminal or administrative prosecution.

The plaintiff also submitted a written statement from an employee in which the employee consented to video surveillance at the workplace at the following locations: production area, parking lot, office, break room, and goods receiving/shipping areas. The defendant subsequently applied to the Hanover Local Court for a search and seizure warrant. Pursuant to the order, the plaintiff’s business was searched on December 15, 2022, by the local police; a video server was seized and examined by the Salzgitter/B-Stadt/Wolfenbüttel Police Department. The police reported that the video server’s hard drive contained 76,421 images and one video file. During the search, it was determined that the plaintiff conducted surveillance on her enterprise with 13 cameras. The surveillance covered the outdoor area, the production area, the office, and the break room. Outside, signs indicating Surveillance were posted, while no such signs were found inside the building.

Both the managing director’s office and the employees’ office contained monitors displaying Surveillance footage. At the time of the search, visitors were present in the employees’ office in addition to the employees. The father of the plaintiff’s managing director at the time stated that the video surveillance was conducted to protect against break-ins. In a letter dated February 10, 2023, the defendant initially notified the plaintiff of the planned directive to deactivate the indoor cameras during business hours and to exclude public thoroughfares from the surveillance coverage in the outdoor area, to prevent third parties from gaining unauthorized access to the monitors displaying the surveillance footage, to post signage with the necessary notices regarding video surveillance, and to submit a record of processing activities. The plaintiff subsequently stated that the indoor cameras had already been deactivated.

It would exclude public traffic areas from the coverage of the outdoor cameras. It currently operates only one doorbell camera. The monitor is now operated in such a way that unauthorized third parties cannot view the footage, and informational signage will be added. Since employee monitoring is no longer taking place, data processing occurs only occasionally, meaning that a record of processing activities does not need to be submitted. At the plaintiff’s request, the video server was returned on May 31, 2023. In a letter dated August 16, 2023, the defendant heard the plaintiff’s comments regarding the planned directive to delete personal data of third parties and employees from the video server and to submit a record of processing activities. The defendant also planned to find that the plaintiff had violated the lawfulness of data processing and the principle of storage limitation, and to issue a warning for the violation of the obligation to submit a record of processing activities.

Since the plaintiff’s doorbell camera collects personal data—namely, image data of the person ringing the doorbell—every time the doorbell is triggered, this does not constitute merely occasional data processing; therefore, the plaintiff is obligated to maintain and submit a record of processing activities. Consequently, on September 4, 2023, the plaintiff submitted proof of the erasure of the recordings and a record of processing activities. In a decision dated September 14, 2023, the defendant determined, with respect to point 1a), that the plaintiff had violated the principle of lawfulness of processing (Art. 5(1)(a) in conjunction with Art. 6(1) of the GDPR) and, under point 1b), that it had violated the principle of storage limitation (Art. 5(1)(e) in conjunction with Art. 17(1)(a) of the GDPR). Regarding point 2), he issued a warning to the plaintiff for violating the obligation to maintain and submit a record of processing activities.

He stated that he was authorized to determine the violations and issue the warning pursuant to Article 58(2) of the GDPR. He essentially justified the finding of legal violations in point 1) as follows: There was no legal basis for the surveillance of work areas, break rooms, or public common areas. No such basis can be found either in Section 26 of the Federal Data Protection Act (BDSG) or in Art. 6(1)(f) of the GDPR. There was also no legal basis for the storage of the recordings. During the seizure on December 15, 2022, he determined that the oldest video surveillance recording was dated September 12, 2021. Despite notifications from the fine-imposing authority on May 31, 2023, and a reminder on July 19, 2023, no evidence of erasure had initially been provided. However, pursuant to Article 17(1)(a) of the GDPR, the controller is obligated to erase personal data without delay when it is no longer necessary for the purposes for which it was collected.

In view of the serious violations, the defendant concluded that a warning would not be sufficient, so the identified violations would be pursued separately in administrative fine proceedings. Regarding the warning in point 2), he explained that a record of processing activities must be maintained pursuant to Article 30(1), (5) of the GDPR if the processing of personal data is not merely occasional. The warning was the mildest remedial measure for violations stemming from the past. In a separate notice of cost assessment dated the same day, the defendant set fees of 1,000 EUR pursuant to Sections 23.1.6 and 23.1.9 of the Schedule of Costs under the General Fee Schedule. In it, the defendant calculated a total of ten hours of work, of which four hours each were allocated to the hearings on February 10 and August 16, 2023, as well as half an hour each for the initiation of the proceedings and the cover letter dated August 2, 2022, the plaintiff’s reminder and the hearing on November 3, 2022, the data protection review of the plaintiff’s response on May 3, May 2023, as well as the data protection review of the plaintiff’s responses, the conclusion of the proceedings, and the warning letter dated September 14, 2023.

50 EUR for each half-hour or portion thereof. The plaintiff filed a lawsuit against both decisions on October 18, 2023. There was no violation of the principle of lawfulness in data processing. Rather, the employees had given their consent to the Surveillance. As a food-processing facility, the Surveillance was also appropriate, necessary, and proportionate to ensure compliance with hygiene regulations. There had been incidents of vandalism at the facility in the past, which is why the outdoor area was monitored. The principle of storage limitation is outlined only by a discretionary provision. There are no precise statutory regulations regarding the maximum duration of storage. Furthermore, it is disproportionate and violates the prohibition against double jeopardy to both find the plaintiff in violation or issue warnings and to initiate administrative fine proceedings against her for the same violations.

Both measures are punitive in nature. The assessment of costs against the plaintiff is also unlawful, as there is also an obligation to bear costs in the administrative fine proceedings, resulting in double billing. The plaintiff requests that the defendant’s decisions dated September 14, 2023, be set aside. The defendant moves to dismiss the lawsuit. In support of its position, it cites the challenged decisions. The plaintiff’s use of the employees’ declarations of consent is invalid because they were not given voluntarily. With regard to the limitation of the storage period, it is the view of all German and European data protection supervisory authorities that video surveillance footage should generally be subject to erasure after 48 hours, as this period is sufficient to determine whether retaining the footage is necessary. Due to violations of the principles of lawfulness of data processing and storage limitation, the defendant imposed a fine on the plaintiff.

Ultimately, the finding of a legal violation also constitutes a warning. This is because a warning is itself an administrative act whose content consists of establishing a violation of the GDPR (Matzke, in: Wolff/Brink/von Ungern-Sternberg, BeckOK GDPR, 56th Edition 2026, Art. 58, para. 20, with further references). The warning is limited to the objective determination of a violation; it does not involve any statements regarding subjective characteristics of the persons involved or the question of culpability (Nguyen, in: Gola/Heckmann/Rost, GDPR BDSG, 4th ed. 2026, Art. 58, para. 14). As the defendant’s representatives plausibly explained during the oral hearing, in the past the term “warning” was not used when a fine was imposed in parallel for the same violation, so as not to give recipients the mistaken impression that that the matter was thereby closed. 1. The legal basis for the warning measures set forth in the decision dated September 14, 2023, is therefore Article 58(2)(b) of the GDPR.

Under this provision, the supervisory authority is permitted to issue a warning to a controller or a processor if it has violated the GDPR through its processing activities. 2. The decision is not objectionable from a formal standpoint. As evidenced by the administrative record, the plaintiff was heard, in particular, prior to the defendant’s issuance of the warning decision, in accordance with Section 1 of the Lower Saxony Administrative Procedure Act (NVwVfG) in conjunction with Section Section 28(1) of the Administrative Procedure Act (VwVfG). 3. The decision is also substantively lawful. a. The video surveillance of the plaintiff constituted a violation of the lawfulness of data processing under Article 5(1)(a) and Article 6(1) of the GDPR, as it cannot be based on a valid legal basis. aa. A legal basis for the video surveillance of employees is found neither in § 26 of the Federal Data Protection Act (BDSG) nor in Art. 6(1)(f) of the GDPR.

Regardless of whether § 26 BDSG is contrary to EU law—which, according to the judgement of the Court of Justice of March 30, 2023 (C-34/21 – Hauptpersonalrat), there is some evidence to suggest it is contrary to EU law, the data processing cannot be based on this provision. Video surveillance of employees does not constitute data processing carried out for the purposes of the employment relationship. According to § 26(1) BDSG, personal data of employees may only be processed for the purposes of the employment relationship, if this is necessary for a decision regarding the establishment of an employment relationship or, after the employment relationship has been established, for its implementation or termination, or for the exercise or fulfillment of the rights and obligations of the employees’ representative body arising from a law, a collective bargaining agreement, a company agreement, or a service agreement (collective agreement), or for the representation of employees’ interests.

Data processing is necessary if the employer requires it to fulfill its existing legal obligations—toward the employee or third parties—to fulfill its contractual obligations, or to exercise its statutory or contractual rights. In the present case, the data processing at issue did not serve the employment relationship. It was not necessary for the establishment, performance, or termination of the employment relationships. Although the plaintiff argued that, as a food-processing enterprise, it wished to monitor employees’ compliance with hygiene regulations, Businesses that process food—particularly food of animal origin—are required by the Food Hygiene Ordinance (LMHV) to comply with hygiene regulations. However, continuous video surveillance—especially in break rooms—is not required for this purpose. Instead, Section 4 of the LMHV requires training for employees. There are several quality assurance concepts, such as the HACCP concept required by EC Regulation No. 852/2004 on food hygiene.

Video surveillance is not part of such concepts. Video surveillance was also not necessary for the purpose of criminal prosecution. According to Section 26(1), second sentence, of the Federal Data Protection Act (BDSG), personal data of employees may be processed for the purpose of detecting criminal offenses only if documented factual indications give rise to the suspicion that the data subject has committed a criminal offense in the course of the employment relationship, the processing is necessary for detection, and the employee’s legitimate interest in excluding such processing does not outweigh this, in particular where the Art and extent of the processing are not disproportionate to the occasion. The plaintiff has not sufficiently demonstrated that video surveillance was conducted to detect criminal offenses committed by employees, let alone expressed a sufficient suspicion. Even if that were the case, video surveillance would only be permissible with respect to individual employees.

Furthermore, video surveillance cannot be based on the employees’ consent. On the one hand, the plaintiff has submitted only a sample consent form from one employee. However, the consent of every employee would be necessary. Nor does the consent meet the requirements set forth in Section 26(2), fourth sentence, of the GDPR. Furthermore, for consent to be valid, it must, in particular, be freely given, and Section 26(2) of the BDSG establishes specific conditions for the voluntariness of consent in the context of an employment relationship. Accordingly, when assessing the voluntary nature of consent, particular consideration must be given to the employee’s dependence arising from the employment relationship as well as the circumstances under which consent was given. Consent may be considered voluntary, in particular, if the employee derives a legal or economic benefit or if the employer and the employee pursue similar interests.

As examples of such benefits, the legislative commentary cites the introduction of a workplace health management program to promote health or permission to use company IT systems for personal purposes (BT-Drs. 18/11325 of February 24, 2017, p. 97). Aligned interests may also exist when the employer installs video or GPS Surveillance to protect against robberies (Riesenhuber, in: Wolff/Brink/von Ungern-Sternberg, BeckOK Data Protection Law, 56th Edition 2026, § 26 BDSG, para. 47). Based on this, it cannot be assumed that employees’ participation is voluntary. There are no apparent benefits for the employees or comparable interests. Dispelling any general suspicion on the part of the plaintiff, as the employer, that its employees might disregard hygiene regulations or commit criminal offenses cannot be regarded as a benefit for the employees. As already noted above, it is rather the employer’s duty to ensure compliance with regulations through other, less intrusive measures, without directly resorting to video surveillance.

If the consent form states that the Surveillance serves to protect the enterprise and its employees from theft, these are likely, at most, secondary objectives, since the plaintiff has consistently cited hygiene regulations as the basis for the video Surveillance in the lawsuit. Furthermore, video surveillance for the purpose of detecting criminal offenses committed by employees may be based only on para 2 of § 26 of the Federal Data Protection Act (BDSG). Furthermore, based on a realistic assessment of the company’s organizational structure, it can be assumed that the consent form was provided by the employees in connection with the establishment of the employment relationship. This, too, argues against the consent being voluntary. Furthermore, the legal basis of Article 6(1)(f) of the GDPR is also not applicable in the present case. Regardless of whether this provision still applies due to Section 26 of the BDSG, video surveillance cannot, in any event, be based on this legal basis.

According to Article 6(1)(f) of the GDPR, processing is lawful, among other things, when it is necessary to safeguard the legitimate interests of the controller or a third party, provided that the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, do not override those interests. As a first step, the plaintiff has not, as far as can be determined, carried out such a balancing of interests. Furthermore, as already explained, video surveillance is not necessary for monitoring hygiene or for protection against criminal offenses. bb. The surveillance of public spaces was also carried out without a valid legal basis. The plaintiff has stated that it installed the outdoor video camera to prevent break-ins and vandalism. Nevertheless, the data processing was not carried out to safeguard the plaintiff’s legitimate interests within the meaning of Article 6(1)(f) of the GDPR.

In principle, a legitimate interest may exist if the owner of the premises wishes to protect themselves against theft or trespass (see DSK, Guidance on Video Surveillance by Non-Public Entities dated July 17, 2020, Section 2.2.1.). However, video surveillance for protection against burglaries and vandalism can only be justified as objectively reasonable if there is a threat that goes beyond the general risks of daily life. Such a threat can only arise from factual findings; Subjective fears or a feeling of insecurity are not sufficient. Specific incidents need not have occurred to the surveilling party themselves in every case; rather, the threat may also arise from the fact that comparable incidents or attacks have taken place in the immediate vicinity (Hanover Administrative Court, Judgement of October 10, 2023 – 10 A 3472/20 –, juris para. 50; Berlin Administrative Court, judgement of April 20, 2026 – 42 K 51.25 –, juris para. 18).

The plaintiff has not substantiated her claims in this regard. Even if there had been comparable incidents in the neighborhood in the past, continuous surveillance of the public thoroughfare—even during business hours—was not necessary to protect against burglaries and vandalism. b. The plaintiff violated the principle of storage limitation under Art. 5(1)(e) of the GDPR by storing the video surveillance recordings for longer than necessary. Under this provision, personal data may be stored only for as long as is necessary for the purposes for which it is processed. According to the case law of the Court of Justice, even data processing that was initially lawful may, over time, violate the GDPR if such data is no longer necessary to achieve the purposes for which it was collected or subsequently processed, are no longer necessary, meaning that such data must be erased once those purposes have been achieved (CJEU, Judgement of October 4, 2024 – C-446/21 – Schrems v. Meta Platforms Ireland Ltd, juris para. 56 with further references).

The controller must erase the data not only when the data subject requests it pursuant to Art. 17(1) of the GDPR, but also on its own initiative (CJEU, Judgement of May 13, 2014 – C-131/12 – Right to be forgotten, juris para. 72). The plaintiff stated that it conducted video surveillance to ensure compliance with hygiene regulations and to protect against break-ins, theft, and vandalism. Whether such a crime has been committed can generally be determined within a few hours. From this perspective, the plaintiff could and should have deleted the surveillance footage from periods during which no crime was committed after no more than two days. The same applies to compliance with hygiene regulations. However, the plaintiff retained some data for years. When the video server was seized on December 15, 2022, recordings from September 2021 were found on the server, meaning they were over a year old.

Even after the server was returned in the lawsuit, the plaintiff did not delete the data until September 2023, following repeated requests. c. Finally, the plaintiff also violated Article 30(1) of the GDPR, as it neither maintained a record of processing activities nor submitted it upon the defendant’s (repeated) requests. Under Article 30(1), first sentence, of the GDPR, every controller must maintain a record of all processing activities under its control. Article 30(1), second sentence, of the GDPR specifies the information that the record must contain. Pursuant to Article 30(3) of the GDPR, the record must be maintained in writing, although an electronic format may also be used. It is undisputed that the plaintiff did not maintain such a record during the period of video surveillance and did not submit it to the defendant until September 11, 2023. However, she was obligated to maintain and submit the inventory.

Although, pursuant to Article 30(5) of the GDPR, an enterprise with fewer than 250 employees is not required to do so, this does not apply if the processing carried out poses a risk to the rights and freedoms of data subjects, the processing is not merely occasional, or special categories of data pursuant to Article 9(1) of the GDPR or personal data relating to criminal convictions and offenses pursuant to Article 10 of the GDPR are processed. Data processing is not considered “only occasional” if it occurs regularly—that is, continuously or at specific intervals over a certain period of time, occurs repeatedly or recurrently at specific times, or takes place constantly or regularly (DSK, Notes on the Record of Processing Activities dated February 26, 2025, para. 5; Hartung, in: Kühling/Buchner, GDPR BDSG, 4th ed. 2024, Art. 30, margin note 37). Accordingly, the continuous surveillance of employees and public spaces does not constitute data processing that occurs only occasionally.

The same applies to surveillance via the doorbell camera, which is triggered regularly whenever the doorbell is pressed. d. The warnings were also issued without any error in the exercise of discretion. The defendant was aware of its discretion in selection and decision-making and exercised it correctly. The warnings serve the purpose of establishing a past violation of data protection law. If the violations have since been remedied but the recipient still assumes that his conduct was not unlawful, the warnings are also appropriate and necessary to establish the legal violation in a binding manner. With regard to the warnings under point 1), the defendant has provided a clear explanation of why, in the administrative proceedings, it made the decision solely to establish the violation in the form of a warning and, furthermore, made use of the option to impose an administrative fine in cases of violations that are not merely minor.

Contrary to the plaintiffs’ view, issuing a warning in conjunction with imposing an administrative fine is not disproportionate and does not violate the prohibition against double jeopardy under Article 103(3) of the Basic Law. The prohibition against double punishment applies only to subsequent sanctions based on general criminal laws. Regardless of whether administrative fines as sanctions under administrative offense law fall under this prohibition, a warning under data protection law is in any case not a sanction based on general criminal laws. As already explained, a warning entails a finding of a legal violation. This cannot be construed as a sanction. For while administrative fines pursuant to Article 83 of the GDPR serve a punitive purpose, a warning is an administrative measure that expresses the supervisory authority’s disapproval. In particular, it is not a warning under § 56 OWiG, as was also clearly stated in the decision.

The cumulative application of the warning and the administrative fine is also proportionate. In the Court’s view, administrative fines under Article 58(2)(i) in conjunction with Article 83 of the GDPR and warnings under Article 58(2)(b) of the GDPR may be imposed cumulatively, depending on what is objectively warranted under the circumstances of the individual case. This is supported first and foremost by the wording of Article 58(2)(i) and Article 83(2), first sentence, of the GDPR. Under Article 58(2)(i) of the GDPR, administrative fines may be imposed “in addition to or instead of” measures pursuant to Article 58(2) of the GDPR. The same wording is found in Article 83(2), first sentence, of the GDPR, which states that administrative fines “may be imposed, depending on the circumstances of the individual case, in addition to or in lieu of measures under Article 58(2)(a) through (h) and (j).”

Both provisions also explicitly refer to the warning under Article 58(2)(b) of the GDPR. If the regulator had not intended the parallel imposition of a fine alongside the issuance of a warning, it would have excluded Article 58(2)(b) of the GDPR. The explicit reference in two provisions also argues against the possibility of a drafting error. Although the second sentence of Recital 148 of the GDPR also states that, in the case of minor infringements, “a warning may be issued instead of an administrative fine,” this does not constitute an explicit prohibition against applying both remedial measures in parallel. After all, the first sentence of that Recital states that, in the case of infringements of the GDPR, “sanctions, including administrative fines, shall be imposed in addition to, or in lieu of, the appropriate measures imposed by the supervisory authority pursuant to this Regulation.”

Even if an alternative relationship between the warning and the administrative fine were expressed in the second sentence of Recital 148, the Recital could not be relied upon to interpret the Regulation because it would then clearly contradict the text of the Regulation (see CJEU, Judgement of June 19, 2014—C-345/13—Karen Millen Fashions, juris para. 31). There is also added value in taking both measures cumulatively, so that a warning, in addition to the imposition of a fine, does not appear superfluous but may be necessary: In the case of a warning, the unequivocal finding of the legal violation becomes final as part of the operative part of the decision. In the case of an administrative fine, the explicit finding of the violation is made only in the reasoning section of the decision. If, on the other hand, the legal violation is also definitively established, it becomes easier for those affected by the unlawful data processing to draw consequences from this, such as asserting claims for damages.

II. Finally, the decision setting the costs—which was also challenged—is lawful. The plaintiff’s obligation to bear the costs arises from Sections 1, 3, and 5 of the Lower Saxony Administrative Costs Act (NVwKostG) in conjunction with Items 23.1.6, 23.1.9 of the Schedule of Fees under § 1 of the Regulation on Fees and Expenses for Official Acts and Services (General Schedule of Fees (AllGO)). The amount of the claimed costs corresponds to Sections 23.1.6 and 23.1.9 of the Schedule of Fees pursuant to § 1 of the AllGO, as amended in 2023. Investigations pursuant to Article 58(1)(b) of the GDPR are generally to be billed based on time spent in accordance with Section 23.1.6 if a legal violation is identified as a result of the data protection review. Warnings pursuant to Article 58(2)(b) of the GDPR are also to be billed on a time-and-materials basis in accordance with Section 23.1.9. According to the note on Section 23, a fee of 50 EUR is to be charged for each half-hour or portion thereof of time required.