Video surveillance is used by many companies. This has, for example, economic reasons, as video surveillance is more cost-efficient than a guard service. At the same time, companies have to deal with the permissibility of the video surveillance used. Within the scope of our activities, as external data protection officers, we support companies in all data protection issues. This also includes the topic of “video surveillance and data protection”. In this blog post, we explain which requirements must be met in order to operate a video surveillance system in compliance with data protection law.

It happens in the best companies that employees are suspected of misconduct. This becomes particularly relevant as soon as there is a suspicion of a criminal offense or other serious misconduct in the employment relationship.

There is then no doubt that the company has a justifiable interest in clarifying the suspicion internally and, if the suspicion is substantiated, also in initiating appropriate (labor law) measures.

The Hamburg Commissioner for Data Protection and Freedom of Information Johannes Caspar (Hamburg data protection supervisory authority) has issued an order against Facebook to process data from WhatsApp for its own purposes and ordered immediate enforceability for this.

Even in the context of an employment relationship or after its termination, an employee has the right to information about the processing of his or her data pursuant to Art. 15 GDPR. So far, so clear. As in many cases, the problems begin with a detailed examination.

On 28. June 2021, the European Commission issued the expected adequacy decision for the United Kingdom. This means that the UK is considered a safe third country and data transfers can take place from 01. July 2021 in accordance with Art. 46 GDPR on the basis of this adequacy decision.

In many companies, so-called sanctions list checks or embargo list checks are carried out. The fact that this is a topic relevant to data protection law is often forgotten. However, since personal data is processed in the course of these audits, the scope of application of the GDPR is opened and the requirements must be complied with.

In its decision of February 16, 2021 (Case No.: 2 A 355/19), the Higher Administrative Court of Saarland determined that consent under data protection law to advertising approaches by telephone cannot be proven by the so-called “double opt-in procedure” in connection with an “Internet sweepstake”. The telephone advertising can then also not be based on a legitimate interest according to Art. 6 (1) lit. f DSGVO, as there is an anti-competitive processing.

The right to object – Art. 21 GDPR under the The right to object under Art. 21 GDPR is certainly not as prominent as, for example, the right to data erasure (right to be forgotten) under Art. 17 GDPR. Nevertheless, there are some data protection law subtleties to consider here, which we will highlight in this article.

The General Data Protection Regulation is the central legal standard for the processing of personal data. However, when it comes to its application, one key step is often ignored: Which types of data processing are subject to the General Data Protection Regulation at all?

With the SARS-CoV-2 Occupational Health and Safety Ordinance (Corona-ArbSchV), the legislator has imposed an obligation on employers to offer employees a Corona self- or rapid test at least twice per calendar week (§ 5 para. 1 Corona-ArbSchV). This measure was intended to contain the spread of Corona infection, particularly in the workplace context.