German Court Fines Kebab Firm €8,000 for Unlawful Employee Video Surveillance

Written by AI from the linked story. Not reviewed by an editor. How this works

A doner kebab production facility in Germany was fined €8,000 and formally reprimanded after conducting comprehensive video surveillance of employees without a valid legal basis under the GDPR. The core failure was the absence of a lawful processing ground — such as legitimate interest proportionately balanced against employee privacy rights, or a valid collective agreement — before deploying surveillance systems. This case illustrates that workplace monitoring is not inherently permissible and requires careful legal justification, documented purpose limitation, and data minimisation. Regulators are actively enforcing employee privacy rights, and organisations that treat surveillance as a default operational tool face significant financial and reputational consequences.

Tactical Insight

Immediate actions

Conduct a legal review of all existing workplace surveillance systems to confirm a documented lawful basis under GDPR Article 6 before continuing their operation.
Suspend or disable any surveillance mechanisms that lack a clear, documented legal justification until compliance can be established.

Policy & process improvements

Establish a formal Data Protection Impact Assessment (DPIA) process — mandatory under GDPR Article 35 — for any proposed employee monitoring initiative before deployment.
Define and document explicit, limited purposes for any surveillance system and ensure data retention periods are proportionate and enforced.
Consult with employee representatives or works councils as required by national law before implementing any monitoring technology.

Training & awareness

Train HR, legal, and operational management teams on GDPR obligations specifically relating to employee data and workplace surveillance.
Appoint or engage a qualified Data Protection Officer (DPO) to review monitoring practices and serve as the regulatory point of contact.