Many companies are currently facing challenges in relation to the GDPR compliance of their video surveillance. Main issues in this respect are questions related to transparency requirements and information notices, the need for a data protection impact assessment as well as questions concerning retention requirements and retention periods. The German Federal Labor Court (BAG) has recently commented on the admissible storage duration of lawful video recordings.

In its judgment dated August 23, 2018 (file ref.: 2 AZR 133/18 - not yet published), the court ruled that an employer is entitled to use six-month-old video recordings, provided the sanction of the violation of obligations by the employer is admissible under labor law. Although the case involved was from 2016, the court made express reference in its decision to the General Data Protection Regulation (GDPR) that has been enforceable only since May 2018.

Background to the decision

The Plaintiff (the employee) worked in a tobacco and newspaper store run by the Defendant (the employer). The Defendant had installed a clearly visible video surveillance camera in the store. When the Defendant detected irregularities in connection with the inventory of tobacco products, he analyzed the video surveillance recordings (which in part were six months old). The recordings showed that the Plaintiff had not entered monies in the cash registers, but rather had kept such monies for herself. The Defendant then dismissed the Plaintiff immediately without a notice period. The Plaintiff's legal action for unfair dismissal was successful before the Labor Court and the State Labor Court (LAG). Both instances came to the conclusion that the evidence gained from the analysis cannot be considered and used against the Plaintiff as contrary to Section 6 (5) BDSG (Federal Data Protection Act) old version, the Defendant had not erased the recordings immediately.

The BAG set the judgment of the LAG aside and referred the matter back to the LAG for rehearing. In the opinion of the BAG, an employer can use the footage recorded if the surveillance itself was admissible (this question must now be checked by the LAG). The situation-related analysis and use of the recordings remains admissible even after six months, and does not violate the Plaintiff's general personal rights (Art 2 (1) in conjunction with Art. 1 (1) of the German Constitution). The Defendant was not obliged to evaluate the footage immediately, but rather was by all means entitled to wait until there was a legitimate reason to study the recordings.

Classification of the judgment in the context of the GDPR

The judgment was issued on the basis of old data protection law. The BAG is nevertheless of the opinion that the result would not have differed under the GDPR. The judgment represents a significant softening of the position compared to the old case law from the year 2008 (BAG, Ruling dated August 26, 2008 – 1 ABR 16/07, NZA 2008, 1187). The BAG has previously assumed that video recordings must be evaluated, and if necessary erased, within a narrow time frame following their creation. This view is also shared by the data protection supervisory authorities. In the opinion of the supervisory authorities, video recordings must be erased immediately if they are no longer necessary for achievement of the purposes for which they were made (Art. 17 (1) lit. a GDPR), or if protection-warranting interests of the data subject are an obstacle to continued storage. Whether backup of the material is necessary is a question that, in the opinion of the supervisory authorities, can generally be clarified within one to two days. Taking account of Art. 5 (1) lit. c and e GDPR - "Data minimization" and "Storage limitation" - erasure should therefore generally take place within 48 hours, as was also the case under the old legal position.

Effects of the judgment in practice

The BAG judgment clearly strengthens the rights and options of employers in terms of evidence related to misconduct by employees. Accordingly, employers are not required to evaluate footage immediately (within 48 hours), but rather can delay evaluation for at least up to 6 months, until a specific reason for evaluation arises. Critical voices see this as risking the creation of a "carte blanche" for permanent storage of video recordings without cause. This can be countered by the argument that the video surveillance must itself be lawful in the first place, and must withstand a proportionality check. It must however be said that the requirements on legally admissible video surveillance are complex. Here too, the devil is in the detail. Operators of video surveillance systems should therefore ensure that they have properly addressed all relevant legal issues related to the design and use of video recordings.