Legally compliant video surveillance in the workplace: avoiding GDPR pitfalls

Imagine walking into your office and suddenly feeling like a film star — cameras everywhere, tracking your every move. Sounds like Hollywood? Unfortunately not. Many companies use video surveillance to ensure security. But without the correct legal basis, this can quickly become a serious data protection problem.

A prominent case: Amazon France Logistique and an expensive lesson

Amazon France Logistique provides a well-known example. In January 2024, the French data protection authority CNIL imposed a substantial fine of EUR 32 million on the company. The reason? Excessive and unlawful monitoring of employee activity through scanners to collect productivity data. This monitoring was not only disproportionate; the data was also retained for too long. A classic case of “Big Brother is watching you” — and it cost Amazon dearly.

The most common pitfalls of video surveillance in companies

Companies often fall into similar traps when it comes to the workplace:

• Unclear legal basis:
  Simply putting up a camera because it seems safer? A no-go without a clear legal basis.
• Lack of transparency:
  Failing to inform employees and visitors about the surveillance? That can quickly become problematic.
• Inadequate security measures:
  If the collected data is not stored securely, you open the door to data misuse.
• Missing documentation:
  Without proper logs and records, enquiries from the authorities become uncomfortable.

Legally compliant video surveillance in the workplace: the data protection requirements under the GDPR and BDSG

Legally compliant video surveillance in the workplace is permitted only within narrow limits. Both the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) set clear rules.

Before installing video surveillance, companies must establish the legal basis on which it rests. The GDPR requires clear justification for every form of data processing. In many cases, a company may rely on legitimate interests under Article 6(1)(f) GDPR — but only if no less intrusive measures are available. The principle of data minimisation also applies: surveillance may extend only as far as strictly necessary. Legally compliant video surveillance also means that comprehensive, permanent monitoring without a specific reason is generally not permitted.

Information obligations and transparency in video surveillance

Another central point is the obligation to provide information. Companies must clearly indicate that video surveillance is taking place in the workplace. This includes information about the controller, the purpose of the surveillance, the legal basis and data subject rights. Companies must also state transparently how long recordings are retained — blanket, long-term retention periods are not permitted.

In most cases, video recordings should not be retained for longer than 72 hours unless there is a specific justification for a longer period.

Data subject rights and data protection impact assessment (DPIA)

The rights of the persons concerned also play a major role. People who are filmed have a right of access to the stored data, a right to erasure and the option of objecting to processing.

When using video surveillance in the workplace, companies must ensure that such requests are processed within the relevant deadlines. In addition, a data protection impact assessment (DPIA) may be required in certain cases, particularly where surveillance poses a high risk to the rights and freedoms of the persons concerned — for example, intensive monitoring of employees.

Technical and organisational measures (TOMs)

The collected data must be protected appropriately so that unauthorised third parties cannot access it. These technical and organisational measures, or TOMs, include encryption, access restrictions and secure storage systems.

Companies must also maintain records of processing activities pursuant to Article 30 GDPR, documenting the processing activities in detail. Without this documentation, video surveillance cannot be implemented in a legally compliant manner. And that can have unpleasant consequences during an inspection by the data protection authority.

Another practical case: covert video surveillance and its limits

Another incident illustrates the risks of unlawful video surveillance: an employer had an employee on sick leave monitored by a detective agency in order to uncover allegedly feigned incapacity for work. In November 2024, the German Federal Labour Court ruled that this covert surveillance violated the GDPR and awarded the employee compensation. The judges stressed that covert surveillance without an adequate legal basis infringed the employee’s right of personality (BAG, judgment of 25 July 2024, case no. 8 AZR 225/23).

A complete GDPR-compliant package for video surveillance in the workplace

To avoid falling into the same traps, our clients rely on a modular complete package:

• legal advice from specialists
• comprehensive audit of planned or existing video surveillance systems, documenting all relevant legal and technical aspects
• compliant design of information signs — from advance signage to camera notices
• preparation of policies and works agreements for internal regulation
• template log for the traceable evaluation of video recordings
• processing notification with risk assessment in accordance with the GDPR
• clear records of processing activities pursuant to Article 30 GDPR
• where required, a data protection impact assessment (DPIA) and recommendations on the technical design of video surveillance

Security with a sense of proportion

Legally compliant video surveillance in the workplace can be a useful instrument — if implemented correctly. Anyone who violates the GDPR risks high fines and the trust of employees.

With our support, you can ensure that your measures are not only effective but also legally compliant. This helps you avoid costly penalties and gives employees and customers peace of mind — without any Hollywood drama.

Enquire now