A violation of the GDPR occurs in particular if the data is processed without a corresponding legal basis. This was the case in the present case, in that a fitness studio in Bavaria monitored the entire training area without any gaps, and collected a prohibition order from the Bavarian State Office for Data Protection Supervision (BayLDA) for this. However, the gym saw this sanction as an opportunity to take administrative action against the data protection supervisory authority itself. The Ansbach Administrative Court (VG) now ruled on February 23, 2022 (Case No. AN 14 K 20.00083) that the BayLDA, which had been sued by the gym, had legally and proportionately prohibited the video surveillance as a remedial measure under Article 58 (2) of the GDPR (paras. 43-44 et seq.). The action brought by the gym, on the other hand, was “only justified to a minor extent” (para. 26).
No legitimate interest
The BayLDA’s decision, which was contested at the VG, was justified on the grounds that “although Article 6 (1) (f) of the GDPR could be considered as the legal basis for the monitoring, the conditions for this were not met” (para. 15). According to the BayLDA, the gym had incorrectly stated the interests of the exercisers as legitimate interests because it was not “obliged to avert any danger or damage”: the gym could only pursue its own interests as legitimate. Moreover, this legal basis failed because there were milder means than video surveillance – e.g., increased staffing or anti-theft devices on the training equipment. The court also ruled in favor of the interests of the trainees and their right to informational self-determination pursuant to Art. 1 (1) in conjunction with Art. 2 (1) GG. Article 2 (1) of the German Basic Law and accordingly gave the right to the BayLDA in this dispute (elabor.: paras. 35-42).
The judges in Munich also reviewed other legal bases for the monitoring and could not base it on the consent of the trainees pursuant to Article 6 (1) (a) of the GDPR, because such consent must be given pursuant to Article 4 No. 11 of the GDPR “voluntarily for the specific case, in an informed manner and unambiguously in the form of a declaration or other unambiguous affirmative act by which the data subject indicates that he or she consents to the processing of personal data relating to him or her”. The fact that the plaintiff studio had in any way demanded such an “unambiguous confirming act” from the trainees had neither been presented to the court nor had it otherwise become apparent.
The court emphasized that such an act of the trainees could not be seen in the mere acknowledgement of the references to video surveillance in the data protection notices and the signs at the entrance door, because according to EC 32 sentence 3 GDPR, silence or inactivity shall not constitute consent. (para. 32).
No contractual secondary obligations
The VG also did not see in contractual (ancillary) obligations of the fitness studio to protect their clientele from thefts and assaults to the extent presented that a legal basis for lawful video surveillance pursuant to Art. 6 para. 1 lit. b) Alt. 1 DS-GVO was available. The gapless video surveillance in dispute went beyond contractual secondary obligations such as duties of consideration and protection. (para. 33-34).
Video surveillance: Judgment of Koblenz Regional Court 2013
As early as 2013 – long before the GDPR came into force – the Koblenz Regional Court dealt with the question of the permissibility of video surveillance in sports clubs on the basis of ancillary contractual obligations.
At that time, in a fitness club chain, “in order to increase security”, partial areas in the training and checkout areas were monitored by video cameras and individual case-related recordings were stored “insofar and as long as this was necessary for the security of the members and for the clarification of criminal offences”. The members were supposed to agree to this existing and permanent video surveillance after they had been informed about it by a corresponding clause – merely as contractual partners prior to the conclusion of the contract. The sports club chain assumed that this camera surveillance was not objectionable because cameras were open and provided with notices about the video surveillance as well as “the […] wording [of the clause] was in line with data protection.” However, the court ruled in this case that the fitness club chain could not easily stipulate in its GTC clauses that its visitors would be monitored in this way.
Video surveillance: Conclusion
One can conclude from the outlined case law that caution is required when reviewing a legal basis for any data processing process, but especially for video surveillance. With reference to the EDSA Guideline, it should still be remembered that a “subjective feeling of insecurity” is not sufficient justification for video surveillance. Rather, one must – preferably with specialists, according to Art. 25 GDPR already “by design” and “by default” – step by step carefully review each setting and each legal basis.
If you are looking for expert support or have specific questions about the design of video surveillance in compliance with data protection law as well as other data protection topics, please feel free to contact us!
Jan Schwemler absolviert bei der aigner business solutions GmbH eine Ausbildung zum Kaufmann für Büromanagement. Jan hat in der Wirtschaftsschule Passau kaufmännische Abläufe erlernt. Nun lernt er die Umsetzung in der Praxis kennen. Seine Kreativität, Talent für Bildbearbeitung und Leidenschaft für Videoschnitt darf er in unserer Marketingabteilung einbringen. Nicht zuletzt durch seine Mitarbeit dürfen sich unsere Kunden und Follower stets über neue interessante Inhalte auf unseren Social Media Kanälen und in unseren Newslettern freuen.
This post is also available in: German