Video surveillance is the monitoring of rooms or areas using optical-electronic equipment, and it is permitted under data protection law if it is necessary and proportionate.
Legal basis
Private companies generally base video surveillance on their legitimate interest, for example protection against theft or vandalism. This must be balanced against the interests of the people filmed. Areas such as changing rooms, toilets or break rooms are off limits.
Video surveillance must be made apparent by clearly visible signs that contain the key information and refer to the full privacy information.
Retention period and employees
Recordings must be deleted as soon as they are no longer needed. The supervisory authorities regularly consider a retention period of up to 72 hours appropriate; longer periods must be justified.
Where employees are recorded, the works council has a right of co-determination. Systematic large-scale monitoring of publicly accessible areas requires a data protection impact assessment.
Legal provisions
- Art. 6(1)(f) GDPR
- Legitimate interest as the legal basis for private operators.
- Section 4 BDSG
- Video surveillance of publicly accessible areas.
- Art. 35(3)(c) GDPR
- Data protection impact assessment for large-scale monitoring.
- Section 87(1) no. 6 BetrVG
- Co-determination of the works council.
Related terms.
Legitimate interest / balancing of interests Legitimate interests constitute a legal basis for the processing of personal data under Article 6(1)(f) GDPR. Companies may process personal data on this basis if the processing is necessary for the purposes of the legitimate interests pursued and those interests are not overridden by the interests or fundamental rights and freedoms of the data subjects. Whether these conditions are met must be assessed as part of a balancing test. Where this legal basis applies, consent is generally not required. Data protection impact assessment (DPIA) A Data Protection Impact Assessment (DPIA) is a legally required process for assessing and mitigating risks associated with the processing of personal data. Under Article 35 of the General Data Protection Regulation (GDPR), the controller must carry out a DPIA where a planned processing operation is likely to result in a high risk to the rights and freedoms of natural persons. The aim is to identify data protection risks at an early stage and establish appropriate safeguards. 