VG Ansbach - AN 14 K 20.00083

VG Ansbach - AN 14 K 20.83
Court:	VG Ansbach (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 6(1)(b) GDPR Article 6(1)(f) GDPR Article 58(2)(f) GDPR
Decided:	23.02.2022
Published:
Parties:	Bayerisches Landesamt für Datenschutzaufsicht
National Case Number/Name:	AN 14 K 20.83
European Case Law Identifier:	ECLI:DE:VGANSBA:2022:0223.AN14K20.00083.00
Appeal from:
Appeal to:	Unknown
Original Language(s):	German
Original Source:	openJur (in German)
Initial Contributor:	Fabian Dechent

The Administrative Court of Ansbach held that the video surveillance of training areas in a gym was not lawful under Article 6(1)(b) GDPR and 6(1)(f) GDPR, and that the DPA was entitled to require the controller to refrain from using video cameras.

English Summary

Facts

The controller runs a gym. The defendant is the Bavarian DPA (BayLDA). The controller and the BayLDA were in dispute about the lawfulness of a video surveillance with six video cameras in the training rooms and the counter of the gym.

The controller argued that the video surveillance served to prevent and solve thefts and damage to property, which had occurred several times in the past. In addition, the video surveillance served to prevent sexual harassment, as a continuous presence of the staff in all rooms could not be guaranteed.

After a client of the controller requested the BayLDA to stop the video surveillance, the BayLDA issued a notice. It required the controller to refrain from observing the training areas with video cameras pursuant to Article 58(2)(f) GDPR. After that, the controller replaced the the video cameras with dummy cameras. The BayLDA argued that, while the legal basis for the video surveillance can generally be Article 6(1)(f) GDPR, the conditions were not met in the present case. In particular, the video surveillance was not not necessary as the controller could have considered less restrictive means such as increased staff and anti-theft devices.

The controller argued that, due to the contractual relationship with the clients, it also had a secondary obligation to ensure their safety, in particular by preventing or solving thefts and assaults through video surveillance. In addition, the data subjects would be informed about the monitoring via signs and the general terms and conditions, thereby also consenting to the video recordings. The controller claimed that, after replacing the video cameras with dummy cameras, it could expect yearly damages in the amount of €10,000 to €15,000 since the clearance rate without the video camera was almost zero.

Holding

The court held that the video surveillance was not lawful and that the BayLDA was entitled to require the controller to refrain from using video cameras in training areas pursuant to Article 58(2)(f) GDPR.

The court held that the video surveillance was not lawful pursuant to Article 6(1)(a) GDPR as the data subjects had not given their prior consent. Consent requires the clear and affirmative act of data subjects. Such act cannot be seen in the mere acknowledgment of signs and the data protection notices.

The video surveillance in dispute was also not lawful pursuant to Article 6(1)(b) GDPR. Contractual secondary obligations such as duties of consideration and protection may be covered by Article 6(1)(b) GDPR, but the continuous video surveillance in dispute went beyond these obligations. Therefore, the video surveillance was not necessary for the fulfilment of these secondary obligations as video surveillance of the training areas is not necessary. It is not in line with the general public's view to protect data subjects in gyms from assault and thefts through uninterrupted video surveillance or to make it easier for the controller to prosecute such incidents through video surveillance.

The court also held that the video surveillance was not lawful pursuant to Article 6(1)(f) GPDR. The interest of the data subjects, namely their fundamental right to informational self-determination, prevailed. The continuous video surveillance in the gym on all training areas was a serious encroachment on this fundamental right of data subjects without any possibility of alternative space or time. Because of this lack of alternative for data subjects alone, their interests outweighed those of the controller. There were other, possibly not equally effective, but at least sufficiently effective measures available to the controller to protect its interests, such as an increase in staff. This was further aggravated by the fact that the data subjects did not have to expect video surveillance in the gym. Even when considering the extent of the damages suffered, no other weighing of the interests was justified. The damage to property amounts to approximately €10,000 to €15,000 per year, while the income amounted to €200,000 in 2019. The legitimate interests of the data subjects themselves also did not justify a different result of the weighing as the ability to exercise in the gym without video surveillance overrides the interest in being protected from general risk of life by means of video surveillance.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

tenor
1. Section II of the decision of the defendant dated December 12, 2019 is repealed. Moreover, the application is dismissed.

2. The plaintiff bears the costs of the proceedings.

3. The judgment is provisionally enforceable with regard to the costs. The plaintiff can avert enforcement by providing security or a deposit in the amount of the fixed costs if the defendant does not provide security in the same amount before enforcement.

4. The appeal is allowed.

facts
The parties are arguing about the admissibility of video surveillance under data protection law.

The plaintiff runs a fitness studio in ... which has, among other things, a training area, areas with chairs and changing rooms with lockers. The training area is divided into a large, L-shaped room with a reception desk and two smaller rooms. Existing fitness equipment is on the one hand cardio equipment (e.g. cross trainer) and on the other hand equipment for strength training with individually movable weight plates and dumbbells of different sizes. All three training rooms are video-monitored throughout the entire area during opening hours (without sound recording), the recordings are saved for 48 hours and then deleted. Corresponding information signs are located on the inside and outside of the entrance door. The gym staff consists of one trainee and three €450 employees.

In a letter dated January 29, 2018, a customer of the plaintiff turned to the defendant as the responsible data protection supervisory authority and described the described video surveillance in the entire training area. The defendant then asked the plaintiff in a letter dated January 31, 2018 to comment on this using a questionnaire.

In a letter dated February 21, 2018, the plaintiff answered the questions to the effect that the entire training area, including the counter area, was continuously monitored during opening hours with six installed video cameras without sound recording. Video surveillance serves to prevent and clarify theft and damage to property, which have occurred several times in the past. Milder means such as warnings would not have been successful.

In a letter dated April 23, 2018, the defendant informed the plaintiff that video surveillance was inadmissible because the legitimate interest of the trainees in freedom from surveillance in the leisure sector outweighed the interests asserted by the plaintiff. The permanent monitoring of the trainees constitutes a significant encroachment on their right to informational self-determination. A milder measure would be, among other things, to only protect areas that are specifically endangered, such as the mirror walls and the meter in front of them, with video surveillance. The plaintiff was asked to stop the video surveillance of the training areas and to confirm this to the defendant.

In a letter dated May 10, 2018, the plaintiff replied that video surveillance restricted to certain areas could not serve the purpose of comprehensive prevention and investigation of theft and damage to property. In addition, the video surveillance also serves to protect the female trainees from sexual assaults, since the continuous presence of the staff in all rooms cannot be guaranteed.

With letters from the defendant dated August 16, 2018 and November 7, 2018, the plaintiff was asked to stop video surveillance of the training areas and to confirm this to the defendant, with reference to the overriding interest of the trainees in informational self-determination.

In a letter dated September 7, 2018, the plaintiff stated, based on the images sent, that the changed camera settings no longer monitored the entire training area, but only the counter area and the training areas near the mirror wall. From the pictures it can be seen that the video cameras still covered significantly more of the training area than just the meter directly in front of the mirrored walls.

After another request on November 7, 2019 to stop the video surveillance, the defendant issued the disputed decision on December 12, 2019 with the following regulations:

"I. The company ... GbR must refrain from observing the area of the training areas during the general opening hours using optical-electronic devices (video surveillance) and from making image recordings."

II. The company ... GbR must inform the Bavarian State Office for Data Protection Supervision within two weeks after this decision has become final, which measures it has taken to implement the order in Section I.

III. In the event that you do not comply with the obligation in Section I of this notice, or do not do so in full or in a timely manner, a penalty payment of EUR 2,000.00 will be imposed.

IV. You have to bear the costs of the procedure.

V. The fee is set at €100.00.

VI. The expenses result from the attached cost calculation.

The decision was justified by the fact that Article 6 (1) (f) GDPR could be considered as the legal basis for monitoring, but the requirements for it were not met. The plaintiff can only assert her own interests as legitimate interests, at least not those of the trainees, since the plaintiff is not obliged to protect the trainees from any danger or damage. In addition, video surveillance is not necessary, since more staff and anti-theft devices on training equipment, for example, could be considered as milder means. Ultimately, the legitimate interests of the trainees in the freedom from surveillance in their leisure time, in which social contacts are also maintained, prevail as a core element of the right to informational self-determination. Therefore, video surveillance is not permitted. The order to stop video surveillance was also necessary, and the threat of fines was necessary.

Against this, the plaintiff filed a complaint with a brief from her legal representative dated January 14, 2020, received by the administrative court in Ansbach on January 16, 2020, and requested that

to revoke the decision of the Bavarian State Office for Data Protection Supervision in ... of December 12, 2019, Ref.: ....

As justification, the plaintiff stated that due to the contractual relationship with the trainees, she also had the secondary obligation to ensure their safety, in particular by preventing or investigating thefts and assaults through video surveillance. The same is already the case in civil law, e.g. for supermarkets (regarding the obligation to cooperate in clarifying the damage) and innkeepers (regarding the obligation to keep the cloakroom safe, etc.). In addition, the trainers would be informed of the surveillance via signs and the terms and conditions of the contract, which means that they also agreed to the video recordings. In addition, the video surveillance also serves the plaintiff's own legitimate interest in preventing property damage to the inventory and, if necessary, enforcing claims for damages. Also, anti-theft devices on the weight plates in the form of special staff keys do not represent a suitable, milder means, since the largely independent use of the equipment by the trainees would then no longer be possible. An increased deployment of personnel is also not a suitable, milder means, since surveillance comparable to video cameras would require the deployment of eight full-time employees, which is not financially feasible. In addition, retail stores would also be allowed to use video surveillance instead of staff. After all, the interest of the trainees in not being monitored in their free time should not be weighted so heavily, since the entire training area is video-monitored, but not the seated areas used for relaxation and maintaining social contacts. Therefore, the decision is entirely unfounded.

In a letter dated July 9, 2020, the defendant requested

reject the complaint.

The legal basis for the decision is Art. 58 Para. 2 Letter b) GDPR. The video surveillance is not based on the consent of the trainees within the meaning of Article 6 Paragraph 1 Letter a) DS-GVO, since the consent described by the plaintiff through the General Terms and Conditions and the information signs meet the requirements of Article 7 DS-GVO in the absence of a clear action by the consenting not enough. Video surveillance is also not permissible under Art. 6 Para. 1 Letter f) GDPR, since there are milder, equally effective means for all interests worthy of protection asserted by the plaintiff. The trainees could be adequately protected against theft by lockable lockers and against assaults by staff (positioned at the reception desk and on patrols). Damage to property or theft of the fitness studio's inventory could be prevented and tracked by visual checks by the staff and suitable anti-theft devices. The plaintiff could take out insurance for additional risks or had to accept this as a general financial risk.

With regard to the balancing of interests, it should be taken into account that a core area of the trainees' right to informational self-determination, namely leisure activities and interaction with other people, is affected. There is no alternative for them during the training period. This may be accompanied by a loss of impartiality and a certain pressure to adapt. In contrast, the interests of the plaintiff are to be classified as lower. The situation in the gym is not comparable to that in the supermarket, since the staff in the gym also have the task of observing the trainees, registering conspicuous incidents and intervening if necessary. The threat of fines is necessary, the amount of EUR 2,000.00 is necessary and sufficient.

In a letter dated July 23, 2020, the defendant ordered the immediate enforcement of the omission instructed in Section I of the disputed decision, since the ongoing video surveillance significantly violated the trainees' right to informational self-determination and therefore the defendant's interest in enforcement is the interest of the plaintiff in the suspensive effect of their action for annulment.

In a letter dated August 24, 2020, the plaintiff's attorney-in-fact stated that only video surveillance could enable trainees to effectively pursue physical assaults or thefts. Without video surveillance, small weight plates and the like could be hidden in a sports bag or under a jacket without being observed. Lockable lockers would not reduce the risk of theft insofar as most of the trainees take valuables such as smartphones, heart rate monitors, etc. with them into the training room. In addition, based on the floor plan that has now been submitted, it is clear that the personnel costs for a control comparable to video surveillance by employees of the plaintiff would not be financially reasonable, since this would ultimately require eight full-time employees.

In a letter dated January 31, 2022, the defendant argued that the legal basis for Section II of the disputed decision was Article 58(1)(a) GDPR. The person responsible bears the burden of proof of compliance with the GDPR, so that a notification order on the implementation of Section I of the decision was necessary and appropriate. This in particular also because the prohibition order from Section I can be implemented in various ways (e.g. changing the camera orientation, partial blackening or pixelation, etc.). However, the defendant is only able to monitor compliance with the GDPR with knowledge of the specific implementation of the order by the plaintiff.

In the oral hearing on February 23, 2022, the plaintiff explained that since the immediate detention was ordered, only dummy cameras were attached. General damage to property occurs about 20 times a year, major damage to property about three times a year. This would result in damage of between EUR 10,000 and EUR 15,000 per year. The clear-up rate for damage to property is 100% with video surveillance and almost 0% without video surveillance. There are about ten thefts of small appliances a year. The dummy cameras are not as effective as video surveillance for prevention, since word has gotten around that they are dummies. Anti-theft devices in the form of adhesive strips, such as those found in retail stores, would not be an option as they could easily be torn off. Other safeguards are also not suitable. Sexual assaults only existed before the video cameras were installed. The plaintiff found out about this because memberships had been terminated as a result. Without video surveillance, there was no way to get evidence, and there was regularly no answer to inquiries about the perpetrator.

For further details of the facts and the submissions of the parties involved, reference is made to the content of the court and authority files and the minutes of the oral hearing of February 23, 2022.

reasons
The lawsuit is admissible, but only to a limited extent.

1. The action is admissible as an action for annulment in accordance with Section 20 (2) BDSG in conjunction with Section 42 (1) alternative 1 VwGO and is also admissible in other respects.

2. However, the complaint is only justified insofar as it is directed against Section II of the disputed decision. Otherwise, it was dismissed as unfounded.

The Bavarian State Office for Data Protection Supervision is the real defendant according to § 20 Section 4, Section 5 Sentence 1 No. 2 BDSG.

a) The cease-and-desist order in Section I of the disputed decision is formally and substantively lawful. No procedural errors are apparent, in particular the plaintiff was properly heard within the meaning of Article 28 BayVwVfG (cf. also GDPR recital 129).

As a remedial measure, the prohibition order is based on Art. 58 (2) GDPR. Since this is a prohibition, letter f) is relevant, not letter d) as alleged by the defendant. The prerequisite for the remedial measures of Art. 58 (2) GDPR is the existence of a violation of the GDPR (cf. Nguyen in: Gola, GDPR, Art. 58, para. 4). Such a violation occurs in particular when data is processed without an appropriate legal basis. This was the case here.

(1) The video surveillance could not be based on the consent of the trainees. According to Art. 6 Para. 1 Letter a) GDPR, personal data may be processed if the data subject has given their consent. According to Art. 4 No. 11 DS-GVO, such consent requires a voluntary, informed and unequivocal declaration of intent in the specific case in the form of a declaration or other clear confirmatory action with which the data subject indicates that they agrees to the processing of personal data concerning them. However, such a clear affirmative action by the trainee cannot be seen in the mere acknowledgment of the information on video surveillance in the data protection information and the information signs on the front door, because according to sentence 3 of GDPR recital 32, silence or inactivity should not constitute consent . The fact that the plaintiff would otherwise have demanded the consent of the trainees to the video surveillance by means of a clearly confirming action is neither stated nor otherwise evident, so that the video surveillance was not permitted under Article 6 Paragraph 1 Letter a) GDPR.

(2) The video surveillance could also not be based on the plaintiff's contractual (ancillary) obligations to protect its customers from theft and assaults to the extent stated. According to Art. 6 Para. 1 Letter b) Alt. 1 DS-GVO, data processing is lawful if it is necessary for the performance of a contract to which the data subject is a party. Although secondary contractual obligations such as consideration and protection obligations are also covered by this provision (Buchner/Petri in: Kühling/Buchner, DS-GVO BDSG, Art. 6, para. 33), the disputed complete video surveillance went beyond these obligations. According to the settled case law of the BGH, anyone who creates a dangerous situation - such as here by operating a fitness studio - is fundamentally obliged to take the necessary and reasonable precautions to prevent damage to others as far as possible; This includes those measures that a prudent and understanding operator, who is prudent within reasonable limits, considers necessary and sufficient to protect others from damage (cf. BGH NJW 2018, 2956, para. 17 with further references). However, it is not necessary to provide for every conceivable possibility of damage occurring, but only to achieve a level of safety that the prevailing view of traffic in the respective area considers necessary (cf. BGH NJW 2018, 2956, para. 18 with further references).

To what extent the plaintiff should have a duty to protect that goes beyond maintaining the fitness equipment and providing helpful staff and lockers or the like is not comprehensible. It cannot be assumed that it is in line with the prevailing public opinion in fitness studios to protect the trainees from attacks and theft by means of complete video surveillance or to make it easier for them to follow such incidents through video surveillance.

(3) Finally, the legitimate interests of the plaintiff or the trainees themselves could not justify the video surveillance. According to Art. 6 Para. 1 Letter f) DS-GVO, data processing is lawful if it is necessary to protect the legitimate interests of the person responsible or a third party, provided that the interests or fundamental rights and freedoms of the data subject do not violate the protection of personal data Data require prevail [...]. Although the plaintiff can assert legitimate interests within the meaning of the provision (see (a)), for the protection of which video surveillance is required (see (b)), the interests of the trainees prevail, namely their fundamental right to informational self-determination from Art. 1 Paragraph 1 in conjunction with Article 2 Paragraph 1 of the Basic Law, these interests (see (c)).

(a) The plaintiff asserted her own interests (prevention and prosecution of theft and damage to property) and the interests of the trainees (protection against theft and assault) as legitimate interests. A "good reason" is necessary, but also sufficient for the concept of legitimate interest, i.e. an interest worthy of protection and objectively justifiable (BVerwG, U. v. 27 March 2019 - 6 C 2/18 - marginal number 25 at juris (still to § 6b paragraph 1 BDSG old version)). The assertion, exercise and enforcement of legal claims (such as claims for damages after theft or damage to property) are legitimate interests (Buchner/Petri in: Kühling/Buchner, DS-GVO BDSG, Art. 6 DS-GVO, marginal number 147). Likewise, the interest of the trainees in being protected from theft and assault by a fitness studio operator can be classified as "legitimate" within the meaning of Article 6 Paragraph 1 f) GDPR, since the concept of legitimate interest is to be interpreted broadly; a normative restriction only occurs later as part of the balancing of interests (Albers/Veit in: BeckOK data protection law, Art. 6, para. 50).

(b) The necessity of video surveillance can also be affirmed, since there is no other equally effective means for investigating theft, damage to property and assaults (cf. Buchner/Petri in: Kühling/Buchner, DS-GVO BDSG, Art. 6 DS-GVO, para. 147a) can be seen.

(c) However, the interests of the trainees outweigh the legitimate interests in video surveillance put forward by the plaintiff. The trainees are affected in their fundamental right to informational self-determination as part of the general right of personality from Article 1 Paragraph 1 in conjunction with Article 2 Paragraph 1 GG and in a very significant way. The continuous video surveillance in the plaintiff's fitness studio during the entire opening hours on all training areas is a serious encroachment on this fundamental right of all trainees, i.e. a significant number of people, with no spatial or temporal alternative. Due to the fact that the trainees have no alternative, their interests outweigh those of the plaintiff. It does have other measures at its disposal that may not be as effective, but are in any case sufficiently effective to protect its interests, such as an increase in staff. The plaintiff cannot rely solely on the fact that video surveillance is the economically more sensible alternative to an increase in staff (cf. Buchner/Petri in: Kühling/Buchner, DS-GVO BDSG, Art. 6 DS-GVO, para. 147a).

To make matters worse, the trainees did not have to reckon with video surveillance in the gym. When weighing the interests of both parties, it must be taken into account that, in accordance with sentence 4 of GDPR recital 47, particularly when personal data is processed in situations in which a data subject does not reasonably have to expect further processing, the interests and fundamental rights of the data subject could outweigh the interests of the controller. According to the guidelines issued by the European Data Protection Board (EDPB) in accordance with Art. 70 (1) (e) GDPR to ensure uniform application of the GDPR, the decisive criterion for the interpretation of the concept of reasonable expectation is whether an objective third party reasonably can expect to be monitored in the specific situation (EDPB, Guidelines 3/2019 on the processing of personal data by video devices, version 2.0, para. 36, retrieved from edpb_guidelines_201903_video_devices_de.pdf (europa.eu)). Signs that provide information about video surveillance are irrelevant for determining what a person concerned can objectively expect in a specific situation (EDPB, loc.cit., para. 40). In publicly accessible areas, data subjects can assume that they will not be monitored, especially if these areas are typically used for leisure activities, as is the case with fitness facilities (EDSA, loc.cit., para. 38). Since there is nothing to suggest deviating from this principle in the present case, this also leads to the interests of the trainees being outweighed.

Even when considering the extent of the damage suffered by the plaintiff, no other weighting of the interests is required. According to the information provided by the plaintiff in the oral hearing, the thefts amount to around ten cases per year and the damage to property amounts to around EUR 10,000 to EUR 15,000 per year, while the income in 2019 was EUR 200,000, for example. The plaintiff's financial losses are therefore within a range that is disproportionate to the complete video surveillance of the trainees. If the plaintiff also states in the oral hearing that no anti-theft devices can be implemented sensibly with regard to the small devices, it must ultimately be accepted from a business point of view that not all financial risks can be averted, especially not at the expense of the informational self-determination of the entire customer base.

The legitimate interests of the trainees themselves, which the plaintiff also asserts, do not justify any other result of the weighing up. It is true that for some, video surveillance may trigger a welcome feeling of security rather than an unpleasant pressure to conform. However, the risks of investigating a theft or assault are primarily the responsibility of the trainees themselves, not that of the plaintiff. Anyone who doesn't lock their smartphone in their locker is regularly aware of the facilitated possibility of a theft in the training room in the fitness studio. The trainees should also be aware that the investigation of criminal offenses in a relatively small space among many strangers is part of the general risk to life. It is up to the trainees themselves to minimize this risk if necessary, for example by choosing training equipment near the reception desk or by training in pairs or at a "low-risk" time. The interest of the trainees in being protected from this general risk to life by the plaintiff by means of video surveillance does not weigh as heavily as the interest in being able to train in the gym without being monitored.

The court also sees no comparability here with the retail trade, since on the one hand there is significantly less interference with the general right of personality (regularly shorter stay and also less private activity than in the fitness studio), on the other hand the risk of theft and the difficulties in clarifying the situation are likely to be even higher due to the faster change of customers, the higher number of small items and the easier storage options, for example in jacket and trouser pockets.

Since there was a violation of data protection law due to the lack of a legal basis for data processing by means of video surveillance, the defendant was allowed to take remedial action in accordance with Art. 58 Para. 2 DS-GVO. The supervisory authority has discretion with regard to the choice of the specific remedial measure (cf. DS-GVO-EG 129), which can only be reviewed to a limited extent by a court, Section 20 (2) BDSG in conjunction with Section 114 VwGO. In the present case, errors of discretion with regard to the prohibition order have neither been presented nor are they otherwise evident.

The prohibition order was also proportionate (cf. GDPR recital 129), in particular no milder, equally effective means of achieving compliance with the GDPR can be seen. Since the entire training area was continuously monitored, (subsequent) consent within the meaning of Article 6 Paragraph 1 Letter a) GDPR could not be effectively obtained due to the lack of voluntariness and revocability within the meaning of Article 7 GDPR. A possible order by the defendant under Art. 58 (2) (d) GDPR to make video surveillance an effective part of the contract with the trainees (instead of the mere reference in the data protection information) appears on the one hand with a view to the Civil law regulations on the control of general terms and conditions are problematic (cf. LG Koblenz BeckRS 2014, 1243) and on the other hand would have constituted a significant encroachment on the private autonomy of the plaintiff and therefore would not have been a milder means. The ban on video surveillance was therefore necessary as a last resort. The ban was also appropriate, because the public interest in creating a data protection-compliant condition in the plaintiff's fitness studio outweighs the plaintiff's interest in video surveillance, since there was a serious infringement of the personal rights of the trainees (see also the comments above on Art. 6 Paragraph 1 letter f) GDPR).

b) In contrast, the notification order in Section II of the disputed decision is substantively unlawful and should therefore be annulled, because the disputed decision does not contain any justification within the meaning of Article 39 BayVwVfG (cf. also GDPR recital 129) or discretionary considerations with regard to Section II. The defendant's brief of January 31, 2022 could not change anything about this loss of discretion.

The lack of justification for Section II initially represented a formal error, but this could be remedied by the statements made by the defendant in the brief of January 31, 2022 in accordance with Article 45 (1) No. 2, Section 2 BayVwVfG, so that Section II was formally lawful was.

In this letter dated January 31, 2022, Art. 58 (1) (a) GDPR was named as the legal basis for Section II. With regard to the choice of the investigative powers of paragraph 1 of Art. 58 DS-GVO to be applied in the individual case, the supervisory authority has a discretion (cf. DS-GVO recital 129), which can only be checked to a limited extent by a court according to § 20 paragraph 2 BDSG in conjunction with § 114 sentence 1 VwGO. However, the decision at issue does not contain any statements from which it would be apparent that the defendant recognized and exercised this discretion with regard to Section II of the decision. This alone is a strong indication of a material loss of discretion (BayVGH NVwZ-RR 2008, 787 (787 f.); Stelkens in: Stelkens/Bonk/Sachs, VwVfG, § 39, para. 28 with further references).

Nor can the discretionary considerations set out in Section I of the decision on the prohibition order be transferred to Section II, since these in no way deal with the way in which the implementation of the prohibition could be checked (cf. on the transfer of discretionary considerations BVerwG NVwZ 2007, 470 (471)). All in all, it is simply not evident that the necessary balancing of the public interests and the private interests of the plaintiff took place when choosing the appropriate investigative power to monitor the implementation of the prohibition order. The subsequent submissions of the defendant in the pleading of January 31, 2022 could not be taken into account in this regard, because § 114 sentence 2 VwGO only allows the addition of deficient discretionary considerations, but not the subsequent first-time exercise (BVerwG NVwZ 2007, 470 (471)). After all, there was a loss of discretion.

Section II of the disputed decision was therefore unlawful due to the lack of discretion. In this respect, the plaintiff, as the addressee of the incriminating administrative act, was also violated in her right to economic freedom of action under Article 2 (1) in conjunction with Article 19 (3) GG, so that Section II pursuant to Section 113 (1) sentence 1 VwGO had to be repealed.

c) The formally lawful threat of fines in Section III of the disputed decision is also substantively lawful, in particular a deadline within the meaning of Article 36 (1) sentence 2 VwZVG was effectively set. Although Section III does not itself set a corresponding deadline according to its wording, the reasoning for Section III on page 4 of the disputed decision clearly contains the period intended by the defendant, namely two weeks after the decision has become final. Since the justification for determining the regulatory content of an administrative act is to be used (Stelkens in: Stelkens/Bonk/Sachs, Verwaltungsverfahrensgesetz, Art. 35, para. 76), a deadline within the meaning of Art. 36 (1) sentence 2 VwZVG is correct in the present case been set. The specificity according to Art. 37 BayVwVfG is also maintained (cf. Stelkens in: Stelkens/Bonk/Sachs, Verwaltungsverfahrensgesetz, Art. 39, para. 26).

d) The determination of fees and expenses in Sections V and VI has its legal basis in Article 19 Paragraph 6 Clause 1 BayDSG in conjunction with Article 1, Article 2, Article 6 Paragraph 1 Clauses 2 and 3, Paragraph 2 KG and is not objectionable.

3. The determination of costs is based on § 155 paragraph 1 sentence 3 VwGO, because the defendant is only in terms of number II, thus inferior to a small extent. The statement on the provisional enforceability is based on § 167 paragraph 2, paragraph 1 sentence 1 VwGO in conjunction with § 708 No. 11, § 711 ZPO.

4. The appeal was to be allowed pursuant to Section 124a Paragraph 1 in conjunction with Section 124 Paragraph 2 No. 3 VwGO, since the case has not yet been clarified in case law with regard to the question of the admissibility of video surveillance in the fitness studio under the DS-GVO is, has fundamental importance.