Germany
notebooksbilliger.de
GDPR enforcement action by Data Protection Authority of Niedersachsen on 2021-01-08.
Case details
- Authority
- Data Protection Authority of Niedersachsen
- Date
- 2021-01-08
- Controller / Processor
- notebooksbilliger.de
- Sector
- Employment
- Quoted Articles
- Art. 5 GDPR, Art. 6 GDPR
- Type of violation
- Insufficient legal basis for data processing
Summary
The DPA of Lower Saxony (LfD Niedersachsen) imposed a fine of EUR 10,4 million on the electronics retailer notebooksbilliger.de.The company had video-monitored its employees for at least two years without having a legal basis for doing so. Among others, the cameras covered workplaces, sales areas, warehouses and recreation areas. The company stated that the purpose of the installed video cameras was to prevent and investigate criminal acts and to track the movement of goods in the warehouses. However, to prevent theft, a company must first consider milder methods. Moreover, video surveillance to detect criminal acts is only permitted if there is a reasonable suspicion against specific persons. If this is the case, it may be permissible to monitor them with cameras for a limited period of time. At notebooksbilliger.de, however, the video surveillance was neither limited to a specific period nor to specific employees. In addition, the recordings were stored for 60 days in many cases, which was significantly longer than required. Customers of notebooksbilliger.de were also affected by the unlawful video surveillance, as some cameras were pointed at seating areas in the sales area. So far, the fine against notebooksbilliger.de is the highest fine that the LfD Niedersachen has issued under the GDPR.
---UPDATE---
The controller appealed the decision to the Regional Court of Hanover, which reduced the fine to a total of EUR 700,000. The public prosecutor then appealed that decision to the Higher Regional Court of Celle, which subsequently increased the fine moderately to a total of EUR 900,000. Although the courts confirmed the infringement, they found that the DPA had used an incorrect method of calculation and had failed to properly classify the seriousness of the infringement. The discrepancy between the amounts set by the Regional Court of Hanover and the Higher Regional Court of Celle is attributable to the Regional Court of Hanover having adopted an unduly cautious approach to the level of the fine.
Related fines