Electronics store
Non-compliance with general data processing principles
Date de décision
1 janvier 2021
Autorité
Data Protection Authority of Niedersachsen
DE
Secteur
Industry and Commerce
Pays
DE
Droit
GDPRStatut
FINALDescription
The DPA from Lower Saxony has imposed a fine of EUR 16,000 on an electronics store. The company had installed a video surveillance system which permanently recorded employees, customers as well as the company's premises and technical equipment. The CCTV was installed for the purpose of protecting customers, employees, safeguarding the company's property rights and prosecuting criminal acts and vandalism. The DPA stated that the recording of employees was not necessary to ensure the purposes associated with the CCTV and was therefore disproportionate. The DPA therefore found that the controller violated the principle of data minimization under Art. 5 (1) c) GDPR. The DPA also found that the company stored the recordings excessively long and, in addition, had not conducted a data protection impact assessment.