Video surveillance on business premises
A camera presupposes a documented risk situation and a field of view showing no more than necessary. Whether the footage can later be used in court is decided separately.
After a break-in cameras go up at the store, a shop secures its sales floor and captures the till along with it, a camera on the façade shows the pavement outside as well. In all three cases the installation was bought without doubt as to its lawfulness, because a notice sign hangs beside it.
That does not settle the matter. The sign discharges the information duty under Article 13 GDPR and says nothing about whether the camera is permitted.
A need for security is not enough, the risk situation has to be documented
What a camera can be justified with rarely sits in the file where it would have to sit. For businesses the legal basis is Article 6(1)(f) GDPR. Section 4 BDSG does remain in the statute book and is cited in concepts for that reason, yet the Federal Administrative Court assigned the lawfulness of private video surveillance to the Regulation (27 March 2019, 6 C 2.18), and the supervisory authorities do not apply the provision to businesses.
What is required is a risk situation going considerably beyond the general risks of life, and it falls to the controller to establish it.
Carries the justification
- Incidents with date, nature and place, plus the amount of loss
- Criminal complaints and loss reports on file
- Comparable incidents in the immediate neighbourhood
- A typically exposed setting, such as a jeweller or petrol station
Does not
- General crime statistics for the country
- The assumed deterrent effect of the camera
- An unspecified reference to security reasons
- The insurer’s requirement, adopted without one’s own assessment
Less intrusive measures have to be examined before the installation, such as access control, lighting or patrols, and that examination has to be recorded. The controller has to demonstrate lawfulness under Article 5(2) GDPR, and after the event that rarely succeeds.
- A purpose recorded in writing for each camera, not one purpose for the installation
- The incidents establishing the risk situation are evidenced and filed
- The less intrusive measures examined and the reason they were ruled out are noted
- Every camera appears with purpose and retention period in the Article 30 GDPR record
- Where publicly accessible areas are monitored extensively, an impact assessment is on file
The field of view decides, not the purpose of the installation
Whether a camera stays permissible is decided by its field of view and not by the purpose recorded in the register.
Permanent workstations and areas where employees spend longer periods must as a rule not appear, and changing rooms, sanitary facilities and staff rooms not at all. Where employees on a sales floor are captured as a side effect, that remains permissible as long as the surveillance is confined to areas at risk and an unobserved retreat remains. The public space outside the property is not part of it, because no right of domicile can be exercised there.
Step 1: Set the purpose for each camera
One purpose for the whole installation will not do. The purpose determines what field of view the individual camera actually needs.
Step 2: Cut the area back
What is captured is the area at risk, such as displays and shelves holding high-value goods, rather than the room.
Step 3: Mask the remainder irreversibly
Workstations, neighbouring properties and public space are blacked out or pixelated in a way that cannot be undone.
Step 4: Confine the operating times
Against break-ins, surveillance outside opening hours suffices. Where live observation achieves the purpose, nothing is additionally stored.
An audio function has to be disabled irreversibly, because recording the non-publicly spoken word without authority is an offence under section 201(1) StGB. No balancing of interests helps there. Involving the works council under section 87(1) no. 6 BetrVG stands alongside all of this and does not replace the data protection assessment.
After 72 hours the footage is as a rule to be deleted
How long the footage may be kept follows from the purpose and cannot be answered for the whole installation in one go. Whether a loss has occurred is usually established within one or two working days, and the supervisory authorities therefore regard 72 hours as regularly permissible.
The unlawful camera still yields usable footage
Whether footage can be used in unfair dismissal proceedings depends less on the data protection compliance of the installation than is widely assumed. On 29 June 2023 the Federal Labour Court held that no bar on use generally applies to recordings from open video surveillance intended to prove deliberate breaches of contract, even where the surveillance measure was not fully in line with data protection law (2 AZR 296/22).
27.03.2019
BVerwG 6 C 2.18
Private video surveillance is governed by Article 6(1)(f) GDPR, and necessity has to be established.
17.07.2020
Guidance of the DSK
The supervisory authorities do not apply section 4 BDSG to businesses and name 72 hours as the standard retention period.
29.06.2023
BAG 2 AZR 296/22
No bar on use for open surveillance and deliberate misconduct, despite shortcomings of the installation.
22.02.2024
BVerfG 1 BvR 2093/23
The constitutional complaint against that decision is not accepted for decision.
What follows is not an all-clear but a separation. The authority measures its orders and fines against the installation, and usability changes nothing there. For covert surveillance, section 26(1) sentence 2 BDSG requires documented indications before the measure in any event.
How we help
- Before installationWe record purpose, risk situation and the alternatives examined for each camera, so the justification can be demonstrated later.
- The installation is runningWe survey fields of view, retention periods and access rights and say what has to change and what has to be evidenced.
- After an incidentWe secure the sequences, assess usability and conduct the correspondence with the other side and the authority.
Not covered here are recordings by public bodies, for which separate standards apply, and AI-supported image analysis, which triggers further duties under the AI Act.
Cameras on the premises, and no justification on file?
We put the documentation in order before the authority asks for it.
Have the installation reviewedFrequently asked questions
Is section 4 BDSG the legal basis for our cameras?
Not for businesses. On 27 March 2019 the Federal Administrative Court held that the lawfulness of video surveillance for private purposes is governed by Article 6(1)(f) GDPR (6 C 2.18). The supervisory authorities do not apply section 4 BDSG as a legal basis for private persons or companies and give the primacy of the Regulation as their reason. The provision remains in the statute book, which is why concepts keep citing it.
What counts as evidence of a risk situation?
Concrete incidents with date, nature and place, together with the amount of loss and any criminal complaints. Incidents in the immediate neighbourhood can suffice where a temporal, substantive and local connection is demonstrable. General crime statistics do not, and the assumed deterrent effect of a camera does not on its own justify a permanent interference. Exceptionally an abstract risk situation is enough, for instance for jewellers and petrol stations.
May workstations appear in the picture?
Permanent workstations and areas where employees spend longer periods must as a rule not be filmed. Changing rooms, sanitary facilities, break rooms, staff rooms and rest areas are ruled out. Where employees in a publicly accessible area are captured as a side effect, that is permissible as long as the surveillance stays confined to areas at risk and an unobserved retreat remains.
Are 72 hours a fixed limit?
No, they are the standard case. Within one or two working days it can as a rule be established whether a sequence has to be secured. A longer period requires a particular purpose and a reasoned justification, applies only to the camera for which that purpose exists, and only for the times when it actually applies, such as public holidays and company closures. As a default for the whole installation it is not permissible.
Does the works council have to be involved?
Yes. A video installation is a technical device objectively capable of monitoring conduct or performance, which brings section 87(1) no. 6 BetrVG into play. An intention to monitor is irrelevant. The involvement stands alongside the data protection assessment and does not replace it. The procedure and the limits of a works agreement are covered under monitoring in the workplace.
May the cameras record audio?
As a rule not. Recording the non-publicly spoken word without authority is an offence under section 201(1) StGB, and unlike with images no balancing of interests helps there. Where a camera has an audio function, it has to be disabled irreversibly. The point often surfaces only during a review, because the function is active as delivered.