Germany

Electronics store

16,000 €

GDPR enforcement action by Data Protection Authority of Niedersachsen on 2021.

Rank · Sector

#176

of 595 in Industry and Commerce

Rank · Germany

#57

of 116

Rank · All fines

#1,149

of 3,042

Case details

Authority: Data Protection Authority of Niedersachsen
Date: 2021
Controller / Processor: Electronics store
Sector: Industry and Commerce
Quoted Articles: Art. 5 (1) c) GDPR, Art. 17 GDPR, Art. 35 (3) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The DPA from Lower Saxony has imposed a fine of EUR 16,000 on an electronics store. The company had installed a video surveillance system which permanently recorded employees, customers as well as the company's premises and technical equipment. The CCTV was installed for the purpose of protecting customers, employees, safeguarding the company's property rights and prosecuting criminal acts and vandalism. The DPA stated that the recording of employees was not necessary to ensure the purposes associated with the CCTV and was therefore disproportionate. The DPA therefore found that the controller violated the principle of data minimization under Art. 5 (1) c) GDPR. The DPA also found that the company stored the recordings excessively long and, in addition, had not conducted a data protection impact assessment.

Open original source Links to the regulator's original publication or another source.