[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo-0ylIBQo1siC5PDwYw7Ibt1tLa3Ot8NWo3rccr2ZuE":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"b0cefd2c-c11c-4916-9d3d-6f11ea9fb23a","VG Hannover - 10 A 5144\u002F23","vg-hannover-10-a-5144-23-72f9d2","Created page with \"{{COURTdecisionBOX |Jurisdiction=Germany |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=VG Hannover |Court_Original_Name=Verwaltungsgericht Hannover |Court_English_Name=Administrative Court Hannover |Court_With_Country=VG Hannover (Germany) |Case_Number_Name=10 A 5144\u002F23 |ECLI= |Original_Source_Name_1=juris |Original_Source_Link_1=https:\u002F\u002Fwww.juris.de\u002Fstatic\u002Finfodienst\u002Fautoren\u002FD_NJRE001652159.htm |Original_Source_Language_1=German |Original_Source_L...\" Show changes","A German administrative court has upheld a €8,000 fine and reprimand against a doner kebab production facility for unlawfully surveilling employees. The court found violations of GDPR principles, including lack of legal basis and storage limitations, and ruled that the surveillance in break rooms, production areas, and outdoor spaces was excessive. The court also clarified that a reprimand and a fine for the same violations do not constitute double punishment.","German court upholds fine and reprimand for unlawful employee video surveillance.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=VG_Hannover_-_10_A_5144\u002F23&diff=52985&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-09T12:21:19+00:00","2026-09-09T14:00:10.985951+00:00",7,[17,20],{"name":18,"type":19},"GDPR","product",{"name":21,"type":22},"juris","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38,40],{"category":30},{"id":31,"icon":25,"name":18,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},{"category":41},{"id":42,"icon":25,"name":43,"slug":44},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[21,18],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":64},"german-court-upholds-8000-gdpr-fine-for-unlawful-employee-surveillance","German Court Upholds €8,000 GDPR Fine for Unlawful Employee Surveillance","A doner kebab production facility in Germany was fined €8,000 and reprimanded after deploying surveillance cameras in break rooms, production areas, and outdoor spaces without a lawful basis under GDPR. The court found the organisation failed to satisfy core GDPR principles, including lawfulness of processing and storage limitation, meaning footage was likely retained longer than necessary without justification. This case highlights that employee monitoring must be proportionate, purposeful, and legally grounded — surveillance cannot be deployed broadly without documented justification. Organisations that treat physical security monitoring as outside the scope of data protection law expose themselves to regulatory enforcement and reputational harm.",[55,56,57,58,59,60,61,62,63],"GDPR Article 5 – Principles relating to processing of personal data","GDPR Article 6 – Lawfulness of processing","GDPR Article 13 – Information to be provided to data subjects","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IP-1 (Individual Access)","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 A.6.4 – Disciplinary process","ISO\u002FIEC 27001:2022 A.7.4 – Physical security monitoring",{}]