The German Data Protection Conference “Datenschutzkonferenz” (DSK), the central body of data protection commissioners of the German Federal Government and Federal States, has commented on the limits of video surveillance measures in conformity with data protection legislation in its Guidance of 3 September 2020. In the paper, the DSK more precisely specifies the principles defined by the European Data Protection Board (EDPB) on this matter in its Guidelines 3/2019.
In detail, however, its interpretation of the EDPB's Guidelines is very strict. For example, the storage of video material beyond a period of 72 hours is normally only permitted in exceptional cases. Even in case of property offences such as theft, it is possible to establish within one or two working days whether the material needs to be secured. Longer storage periods can only be justified in exceptional cases, which are generally not justifiable by internal work processes. The statements made by the DSK on video surveillance in areas which can only be accessed by employees (e.g. storage rooms) are also interesting. There, video surveillance is only permissible in case of a concrete suspicion of a criminal offence by a narrowly defined group of persons.
The DSK’s strict interpretation is likely to pose problems for retail companies in particular. This is because it is generally not possible to take stock every 1-2 days, which means that longer storage periods are often necessary. In view of the potentially enormous fines (EUR 20 million or up to 4% of the worldwide group turnover) that can be imposed for violations of the GDPR, we recommend that you take this Guideline as an opportunity to check the legality of your installed surveillance systems. In this connection - based on the case law of the Federal Labor Court [Bundesarbeitsgericht - BAG], longer storage periods most certainly can also be justified. We would be happy to advise you on concrete implementation measures.