Video surveillance of dedicated laboratory rejected by single employee [Germany]

Question

We have a dedicated laboratory with very expensive and sensitive equipment. When handled incorrectly, they can cause serious harm to the user or others in the laboratory. Our department consists of 5 people who have access to this laboratory.

Therefore we introduced a couple of safety regulations (only supervised people are allowed to enter, entry-list with date/time, etc). As next step we wanted to install an surveillance camera. The camera is configured that it takes a photo if it detects movement and stores this photo 7 days. We also ordered the corresponding warning stickers that this area is under surveillance. There are no fixed workplaces inside the laboratory. Its plainly for manufacturing, testing and experiments. Everyone in our department has an separate workplace in an non-surveilled area.

We (our department, 5 persons) had a vote if we think this surveillance is ok. Only one guy voted against. He does not want to be surveilled when he works in this laboratory. Its the same guy that always leaves the laboratory like a mess. As we voted 4:1, we are now employing the surveillance measures. However, this guy causes a commotion, throws ramblings about DSGVO and that it is illegal.

Is this really illegal in Germany? It's a dedicated room, a critical area with special safety precautions and requirements. No one has an fixed workplace in this room. We use the photos taken by the surveillence camera only if something went wrong (i.e. accident, intrusion or messy laboratory).

Answer 1

Video surveillance is not necessarily illegal, but you do need a very solid legal basis. You should not install a camera in your lab without going through your department's usual processes, likely involving the data protection officer and the Betriebsrat/Personalrat which MUST sign off on such workplace surveillance measures. I don't quite see how a vote among colleagues could authorize this surveillance.

Your organization's data protection officer should be able to help you to place the video surveillance on safer footing, or to find better alternatives. Implementing video surveillance could first require a written data protection impact assessment (Datenschutz-Folgeabschätzung). Some pointers below.

GDPR/DSGVO compliance starts with three questions:

• What is the purpose for which personal data is being processed?
• What is the legal basis for this processing?
• What means can be used to achieve the purpose, collecting the minimal amount of data necessary?

You need to think further about the purpose for which surveillance is necessary. In particular, a camera does not prevent accidents and there might be less invasive ways to prevent intrusion (such as locking the door). Cameras are a fairly extreme measure, and are typically only used as a deterrent to crime, e.g. to deter robbers at a bank counter.

The legal basis (GDPR Art 6) you choose is quite relevant because consent (opt-in, Einwilligung) is not generally possible in an employment context, and legitimate interest(berechtigtes Interesse) is not available to public authorities. While companies could use a legitimate interest, this interest must be compelling enough to outweigh the rights and freedoms of the affected data subjects even if they object (try to opt-out). In its guidelines to video devices, the EDPB (EDSA) has also mentioned that the legitimate interest must be non-speculative. The mere concern that equipment could be damaged by an anonymous co-worker is not enough, but past incidents could make this interest legitimate – the amount of surveillance must be proportionate to the actual risks.

The disgruntled co-worker could escalate by contacting the data protection officer, lodging a complaint with your state's supervisory authority, or by suing your employer. It is not guaranteed that they would succeed, but it doesn't seem like this instance of surveillance is entirely proper.

I would deactivate the cameras until you are sure that the camera surveillance is being performed legally.