Video surveillance

Video surveillance routinely captures images of identifiable individuals and therefore constitutes processing of personal data under Art. 4(1) and (2) GDPR. For private-sector controllers, the practically decisive legal basis is Art. 6(1)(f) GDPR — a legitimate interest such as protecting property, exercising house rules, or securing evidence. In its judgment of 27 March 2019 (6 C 2.18), the German Federal Administrative Court held that Section 4 BDSG does not apply to video surveillance of publicly accessible areas by private controllers, because the GDPR contains no opening clause for it. Public bodies, by contrast, rely on Art. 6(1)(e) GDPR in conjunction with Section 4 BDSG or the applicable state law. Where employees are captured, Section 26 BDSG applies in addition, and under the CJEU ruling in Ryneš (C-212/13) the household exemption covers private recording only as long as no publicly accessible space is captured.

The heart of the lawfulness assessment is a three-step balancing test. First, a concrete and current legitimate interest must be evidenced — vague security concerns are not enough; documented incidents or a demonstrable risk situation are expected. Second, necessity must be examined: would better lighting, access control, locking systems, or a narrower camera field achieve the same result with less intrusion? Third, the interests of data subjects frequently prevail wherever surveillance pressure is high — in sanitary facilities and changing rooms, break and staff rooms, and where workstations would be monitored continuously. Covert monitoring of employees is permissible only under the narrow conditions of Section 26(1) sentence 2 BDSG and the case law of the Federal Labour Court, meaning a concrete suspicion of a criminal offence. Because of the accountability principle in Art. 5(2) GDPR the balancing exercise must be documented in writing, and systematic large-scale monitoring of publicly accessible areas additionally triggers a data protection impact assessment under Art. 35(3)(c) GDPR.

In practice, transparency and storage limitation decide whether a system stands up to scrutiny. Under Art. 12 and 13 GDPR, data subjects must be informed at the time of collection. The European Data Protection Board (Guidelines 3/2019) and the German supervisory authorities recommend a two-layer approach: a clearly visible sign placed before the monitored area showing a camera pictogram, the controller and contact details, purposes, legal basis, storage period, a reference to data subject rights, and where the full information can be found — with the complete Art. 13 notice provided on a second layer as a posted notice, leaflet, QR code, or web page. For deletion, the GDPR sets no fixed deadline; what governs is the storage limitation principle in Art. 5(1)(e) GDPR. Supervisory authorities regard a retention period of a few days — commonly 48 to 72 hours — as sufficient as a rule for footage kept for security and evidentiary purposes; any longer retention must be justified case by case, for instance while a specific incident is being investigated. Technically this is implemented through automatic overwriting and documented in the deletion concept, the record of processing activities, and the access authorisation concept.