[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz6YC58YXRZb5DyBLeMTGjl6uFOZ83E8T8bQVPehBymA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"e36ce835-1776-479f-b81d-15cdac2878bc","german-court-fines-kebab-firm-8000-for-unlawful-employee-video-surveillance","914898a3-5e0c-4759-8f87-498fc8b0261f","German Court Fines Kebab Firm €8,000 for Unlawful Employee Video Surveillance","A doner kebab production facility in Germany was fined €8,000 and formally reprimanded after conducting comprehensive video surveillance of employees without a valid legal basis under the GDPR. The core failure was the absence of a lawful processing ground — such as legitimate interest proportionately balanced against employee privacy rights, or a valid collective agreement — before deploying surveillance systems. This case illustrates that workplace monitoring is not inherently permissible and requires careful legal justification, documented purpose limitation, and data minimisation. Regulators are actively enforcing employee privacy rights, and organisations that treat surveillance as a default operational tool face significant financial and reputational consequences.","**Immediate actions:**\n- Conduct a legal review of all existing workplace surveillance systems to confirm a documented lawful basis under GDPR Article 6 before continuing their operation.\n- Suspend or disable any surveillance mechanisms that lack a clear, documented legal justification until compliance can be established.\n\n**Policy & process improvements:**\n- Establish a formal Data Protection Impact Assessment (DPIA) process — mandatory under GDPR Article 35 — for any proposed employee monitoring initiative before deployment.\n- Define and document explicit, limited purposes for any surveillance system and ensure data retention periods are proportionate and enforced.\n- Consult with employee representatives or works councils as required by national law before implementing any monitoring technology.\n\n**Training & awareness:**\n- Train HR, legal, and operational management teams on GDPR obligations specifically relating to employee data and workplace surveillance.\n- Appoint or engage a qualified Data Protection Officer (DPO) to review monitoring practices and serve as the regulatory point of contact.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 5 (Principles of data processing)","GDPR Article 6 (Lawfulness of processing)","GDPR Article 9 (Special categories of data)","GDPR Article 35 (Data Protection Impact Assessment)","GDPR Article 88 (Processing in the employment context)","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IR-8 (Privacy Incident Response)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27001 Annex A.6.4 (Disciplinary process)","ISO\u002FIEC 27701 (Privacy Information Management)",{},"published","2026-09-09T14:21:23.817054+00:00","2026-09-09T14:21:23.709+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=VG_Hannover_-_10_A_5144\u002F23&diff=52987&oldid=52985","vg-hannover-10-a-5144-23-f10728","VG Hannover - 10 A 5144\u002F23",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]