Sanction RGPD Data Protection Authority of Niedersachsen — Electronics store : 16 k€ (2021)
- Autorité de contrôle
- Data Protection Authority of Niedersachsen
- Pays
- Allemagne
- Entreprise / secteur
- Electronics store
- Montant de l'amende
- 16 k€
- Date de la décision
- 1 janvier 2021
- Fondement juridique
- Art. 5 (1) c), Art. 17, Art. 35 (3)
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The DPA from Lower Saxony has imposed a fine of EUR 16,000 on an electronics store. The company had installed a video surveillance system which permanently recorded employees, customers as well as the company's premises and technical equipment. The CCTV was installed for the purpose of protecting customers, employees, safeguarding the company's property rights and prosecuting criminal acts and vandalism. The DPA stated that the recording of employees was not necessary to ensure the purposes associated with the CCTV and was therefore disproportionate. The DPA therefore found that the controller violated the principle of data minimization under Art. 5 (1) c) GDPR. The DPA also found that the company stored the recordings excessively long and, in addition, had not conducted a data protection impact assessment.