VG Hannover - 10 A 1443/19
From GDPRhub
| VG Hannover - 10 A 1443/19 | |
|---|---|
 | |
| Court: | VG Hannover (Germany) |
| Jurisdiction: | Germany |
| Relevant Law: | Article 6(1)(f) GDPR Article 58(2)(f) GDPR § 4 BDSG |
| Decided: | 13.03.2023 |
| Published: | |
| Parties: | Data Protection Authority of Lower Saxony |
| National Case Number/Name: | 10 A 1443/19 |
| European Case Law Identifier: | ECLI:DE:VGHANNO:2023:0313.10A1443.19.00 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | German |
| Original Source: | Niedersächsisches Vorschrifteninformationssystem (NI-VORIS) (in German) |
| Initial Contributor: | lacrosse |
A 24-hour self-service petrol station is generally allowed to retain video-surveillance footage for a maximum of 72 hours. Longer storage periods may be accepted under certain conditions according to the Lower Saxony DPA.
English Summary
Facts
The controller operated a 24-hour self-service petrol station with a retail shop, both accessible by everyone. The DPA requested the plaintiff to provide information about the video surveillance. In their response, the controller pointed out, that they had installed cameras in the shop and outdoor, including the self-service gas station area. According to the controller, the self-service gas station property is damaged five to six times a year. It also happened that customers forgot the fuel nozzle in the vehicle and drove off. The video surveillance recordings was stored on a hard drive for about six to eight weeks. The controller added that they determined the annual damage in the gas station operation in the amount of € 10.000 – including vandalism and break-ins. The video recordings had a crucial function with regard to these offences. A storage period reduced to 72 hours was unreasonably short. The controller also argue that compensation for damages would be made considerably more difficult by a 72 hours storage period. In addition, according to the controller, the GDPR Regulation does not provide for any rigid deletion periods.
The DPA ordered the plaintiff to limit the storage period of the video recordings. In the event of non-implementation, incomplete implementation or late implementation, a penalty payment was threatened. The DPA further explained, that it not objected Article 6(1)(f) GDPR as legal basis for the video surveillance. However, any video surveillance encroaches on the fundamental right of natural persons. Video surveillance measures have a high degree of intervention intensity. Numerous people are included in the surveillance action who are not related to specific misconduct. Video recordings should therefore be deleted immediately if they are no longer necessary to achieve the purposes for which they were collected. Although there are no rigid retention limits stated in the GDPR, storage limits are based on the necessity of storage. A day or two should be sufficient to decide whether further storage of the video recordings is necessary. Taking into account the data protection principles of data minimization and storage limitation, deletion should take place regularly after 48 hours. Considering non-working hours at the weekend 72 hours are acceptable. As an exception, a longer storage period is permissible for absences on public holidays.
The controller appealed against the order of the DPA. In the appeal, the controller repeated their previous submissions before the DPA. In particular, the DPA order violated the principle of certainty. The GDPR does not contain any information about the duration of data storage. The plaintiff took the view that § 4 Bundesdatenschutzgesetz (BDSG) is the legal basis for the video surveillance. The self-service petrol is a facility for maintaining public transport and thus an operation in the area of services of general interest, so that it is to be regarded as a public facility within the meaning of the BDSG. § 4 BDSG
Holding
The Administrative Court of Hannover dismissed the lawsuit. The permissible purpose of video surveillance is to prevent and track criminal offenses, in particular vandalism and damage to property. For this purpose, the controller was entitled to collect and store images. However, it was not necessary to keep these records for six to eight weeks to achieve the purpose. It was easily possible to determine within 72 hours whether vandalism or damage occurred and, should this be the case, then to view the video material. If the video material then provides further information on a crime, a controller is entitled to store it for a longer period of time. The court also stressed how EDPB also generally assumes a permissible storage period of 72 hours. A storage period that goes beyond this is possible, but requires a necessity and a particular justification. With regard to the clarification of cases of vandalism and damage to property, the plaintiff has not succeeded in presenting a comprehensible reason why it should not be possible for them to report corresponding incidents within 72 hours.
The decision of the data protection authority to limit the storage period was therefore legally not objectionable. The limitation of the retention period by the authority was based on Article 58(2)(f) GDPR. Accordingly, the supervisory authority can impose a temporary or permanent restriction on processing, including a ban.
Contrary to what the controller believed, the order was not vague. In the disputed decision, it was pointed out that a longer storage period is permissible in the event of absences on public holidays. The DPA also explained that longer storage is possible in cases in which the recorded video is necessary to clarify cases of damage.
Concerning the legal basis for the processing, video surveillance carried out by the controller and the storage of video recording were subject to the regulatory regime of the GDPR. Contrary to what the controller believed, they could not base the video surveillance and storage on § 4 BDSG. This provision is contrary to Union law insofar as it affects non-public bodies. Article 6(1)(e) GDPR and Article 6(3) GDPR only give the member states regulatory leeway to regulate video surveillance that is carried out in the context of a task that is in the public interest or in the exercise of official authority. § 4(1) BDSG, contrary to Union law, allows video surveillance for the exercise of domiciliary rights by non-public bodies.
Comment
See Guidelines 3/2019 on processing of personal data through video devices by the EDPB Page 28 "The longer the storage period set (especially when beyond 72 hours), the more argumentation for the legitimacy of the purpose and the necessity of storage has to be provided."
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the German original. Please refer to the German original for more details.
Hanover Administrative Court
judgment of 03/13/2023, Az.: 10 A 1443/19
Storage duration video surveillance; video surveillance at a self-service petrol station; permissible storage time of a video recording; Legality of a data protection restriction on the storage duration of video recordings; Personal data must not be stored longer than is necessary for the purposes for which they were processed
bibliography
Court
VG Hanover
Date
03/13/2023
File number
10A 1443/19
decision form
Verdict
reference
WKRS 2023, 19572
decision name
[not specified]
ECLI
ECLI:DE:VGHANNO:2023:0313.10A1443.19.00
legal bases
BDSG § 4
GDPR Article 17
GDPR Art. 6
Tenor:
The charges get dismissed.
The applicant shall pay the costs of the proceedings.
The decision is provisionally enforceable because of the costs. The enforcement debtor may avert enforcement by providing security of 110% of the enforceable amount, unless the enforcement creditor provides security of 110% of the amount to be enforced before enforcement.
facts
The plaintiff objects to the defendants' order to limit the storage period of video recordings of their trade to 72 hours.
The plaintiff is an agricultural procurement and sales cooperative. In the municipality of D., it operates a self-service filling station (hereinafter: self-service filling station), which is accessible to everyone 24 hours a day, and a shop. At the gas station, you can only pay by card at a central terminal, cash payment is not possible. The seven pumps can be activated by customers simply by inserting a card and entering the associated PIN. After entering the PIN at the central terminal, the customer must select the dispenser that he wants to use. As soon as the pump nozzle is hung up again after refuelling, the refueling process is complete and the payment is triggered. The following cards are accepted as payment:
- Girocard (ec card) and maestro with PIN
- Visa card with PIN
- Mastercard with PIN
- American Express Card with PIN
- Own fuel cards with PIN
On May 7, 2018, the defendant was notified that the plaintiff had installed video cameras in her shop without referring to video surveillance. On the occasion of this notification, the defendant requested the plaintiff to provide information in a letter dated August 16, 2018, setting a deadline and sent her a catalog of questions. The plaintiff provided the requested information in a letter dated October 4, 2018 and essentially said: She had installed cameras in the shop, in its outdoor area and in the area of the self-service gas station. In the area of the self-service filling station, damage to property occurs five to six times a year, sometimes with hit-and-runs. Some customers would forget the fuel nozzle in the vehicle and drive off. This would result in damage to the petrol pumps, each amounting to up to EUR 7,000.00. The video surveillance recordings would be stored on a hard drive for about six to eight weeks. It is a ring storage in which the recordings would be deleted by dubbing them with new recordings.
In a letter dated October 19, 2018, the defendant pointed out to the plaintiff that the video surveillance she had carried out in the form shown was partially inadmissible under data protection law - in particular with regard to the storage period described. The automated periodic deletion through self-overwriting must take place after 72 hours at the latest, taking into account the non-working times on the weekends. The plaintiff then reported on November 16, 2018 that she had to determine annual damage in the gas station operation in the amount of EUR 10,000.00. She is also affected by vandalism and break-ins. The video recordings have a crucial function with regard to these offences. A storage period reduced to 72 hours is unreasonably short. A fourteen-day period is appropriate.
In a letter dated November 27, 2018, the defendant stated that it was recognized in individual cases that a storage period longer than 72 hours could be necessary due to public holidays. Apart from these special cases, however, it is not clear why longer storage of the video recordings could be necessary. The plaintiff then referred in further letters to the clarification of cases of damage, which would be made considerably more difficult by a shorter storage period. In addition, the General Data Protection Regulation does not provide for any rigid deletion periods. She assured that a storage period of 10 days would be set up for the future.
In a decision dated February 18, 2019, the defendant ordered the plaintiff to limit the storage period of the video recordings so that, as a rule, 72 hours would not be exceeded. The change in storage periods must be confirmed by March 26, 2019. In the event of non-implementation, incomplete implementation or late implementation, a penalty payment of EUR 1,000.00 is threatened. As justification, the defendant essentially states: The video surveillance of the proven detection areas, which the plaintiff carried out in principle, is not objected to on the basis of Article 6 (1) (f) of the General Data Protection Regulation (GDPR). However, any video surveillance encroaches on the fundamental right of the persons concerned to decide for themselves on the disclosure and use of their personal data, and also affects the fundamental right to their own image. Video surveillance measures show a high level of intervention intensity, since these are usually non-suspicious interventions in which numerous people are included in the sphere of action who are not related to specific misconduct and who did not cause the intervention through their behavior. Video recordings should therefore be deleted immediately if they are no longer necessary to achieve the purposes for which they were collected. Although there is no legal regulation that provides for rigid deletion periods, the legislator is based on the necessity of storage. Within one to two days it should be clarified in principle whether it is necessary to back up the recorded material. Taking into account the data protection principles of data minimization and storage limitation, deletion should take place regularly after 48 hours. If you include non-working times at the weekend, storage of up to 72 hours is acceptable. As an exception, a longer storage period is permissible for absences on public holidays. Beyond these cases, however, it is not clear why the plaintiff needs a storage period of more than 72 hours. In particular, the extent of damage to the plaintiff determined in the past does not constitute sufficient justification for a storage period of ten days. The regulation made is suitable for enabling video surveillance and recording evaluation within a framework permissible under data protection law. It is also necessary and appropriate.
With a separate decision on the assessment of costs on the same day, the defendant assessed costs of EUR 472.50 against the plaintiff for the implementation of a data protection investigation.
On March 21, 2019, the plaintiff brought an action against the two decisions of February 18, 2019. In justification, she essentially states:
The defendant's data protection order violated the principle of certainty. For organization in your small business, a fixed specification of the storage period is essential, since the viewing of the video material is only the responsibility of the managing director or board of directors authorized to do so.
The law, and specifically the GDPR, does not contain any information about the duration of data storage. Accordingly, there is already a lack of a legal basis for the order made by the defendant. For the video surveillance itself, it can be based on Section 4 of the Federal Data Protection Act (BDSG). Insofar as the Federal Administrative Court denied the applicability of this provision to private individuals in its judgment of March 27, 2019 (Az.: 6 C 2.18), this does not apply to the present case because the decision does not cover the legal situation after the GDPR came into force. In addition, the self-service filling station is a facility for maintaining public transport and thus an operation in the area of services of general interest, so that it is to be regarded as a public facility within the meaning of the BDSG. According to Art. 17 GDPR and § 24 Para. 1 No. 2 BDSG, longer storage is possible. Finally, she can also refer to Art. 6 (1) lit. f) GDPR. None of these regulations make time specifications for the storage period.
The video recording serves various purposes. These purposes justify a longer retention period. As the operator of a gas station in a rural area, she is exposed to a considerable risk that customers will not pay for the fuel they have filled up. Unpaid fuel has an enormous economic relevance for them. The clarification of such cases cannot be guaranteed within 72 hours. The special features of civil law with regard to the constellation of a self-service filling station should also be taken into account. The purchase contract between the customer and the gas station operator comes into existence as soon as the tank is filled. The purchase price is due upon completion of the refueling process. By mixing the fuel in the customer's tank, the customer already acquires co-ownership of the fuel. It is often the case that customers only claim after three days that their card was wrongly charged and that they did not fill up their vehicle at the plaintiff's petrol station. In the case of refueling a truck, this would involve a tank load worth around EUR 1,000.00. Cases in which a refueling is denied despite the charge on the card occur about four to five times a month. In the worst case, annual damage of EUR 60,000.00 would be expected. She relies on the video recordings to enforce her purchase price claims. In addition, she sees herself exposed to reversal claims under Section 812 et seq. of the German Civil Code (BGB). She is burdened with the burden of proof both to enforce corresponding civil law claims and to defend against such claims. The video recording serves as evidence for this. Claims under civil law usually only became statute-barred after three years. You are then generally entitled to data storage for the corresponding period of time. It is true that the contractual agreements between the card systems and the merchants are designed in such a way that the use of the PIN creates a payment guarantee, but this does not apply without restrictions. In cases of misuse, the card company has the option to object or refuse to pay. In this respect, the regulation of § 675w BGB should also be taken into account. Payment by card using a PIN is only prima facie evidence of the refueling process, but not full legal proof - like a video recording. In addition, they also accept fuel cards that are billed monthly via a SEPA direct debit. Customers can object to their banks within eight weeks without giving any reason. The bank then posts the money back to the customer's account and posts part of the amount assigned to the plaintiff back.
Corresponding cases are also to be assessed as criminally relevant cases of fuel fraud. The official imposition of the withholding/destruction of admissible evidence could fulfill the criminal offense of Section 339 of the Criminal Code (StGB).
There were also cases where customers accidentally unlocked two pumps. The background is that the customer first activates the wrong petrol pump via the central terminal and after recognizing this error another (the correct) petrol pump. This incorrect operation cannot be countered technically. In connection with such cases, she has faced criminal allegations in the past because customers later found out that their card had been charged for two fuel transactions (their own and the one at the pump that was accidentally activated). She was then able to exonerate herself by means of the video recordings.
Video surveillance also serves to clarify cases of vandalism and damage to property. In the gas station operation, damage of around EUR 10,000.00 can be determined every year. The recordings therefore have an important educational function.
The application and use of various data protection guidelines and orientation aids also indicate that she is entitled to store the video recordings for a longer period of time.
A longer storage period is initially permissible in your case using the "Guidelines 3/19 on processing of personal data through video devices" of the European Data Protection Authority.
Furthermore, the principles developed by the data protection conference for ATMs should be applied to self-service filling stations. According to this, significantly longer storage periods - up to 142 days - are permissible. In these case constellations, the data protection conference recognized that civil law regulations regarding the storage period are decisive. In the present case, the civil law statute of limitations must also be taken into account when determining the storage period. The Hessian data protection supervisory authority summarized this accordingly in a current information letter dated March 25, 2020. In the case of video surveillance by public authorities, the Bavarian C. has recognized or regulated that a longer storage period is permissible beyond the period of two months, also for the assertion of legal claims. The State Commissioner for Data Protection and Freedom of Information for the Saarland also recognized that a differentiated storage period for video surveillance was justified for banks. The recommendations of the Federal Criminal Police Office (BKA) for ATM demolitions also provide for a minimum recording period of 72 hours. In addition, reference should be made to the legal handling of the data protection conference with regard to video surveillance at banks and ATMs, which provide for significantly longer storage periods. Finally, in view of the dangerous situation at a gas station, the rules "Handling means of payment in sales outlets" of the German statutory accident insurance, central association, BGR/GUV-R141, which recommended or required open video surveillance, should also be observed. According to the case law of the Lower Saxony Higher Administrative Court, she is entitled to store the recordings for a longer period of time.
The defendant also misjudged that the actual recording duration was a business secret. You should not be forced to disclose the actual maximum eight-week period and thus invite potential fraudsters to abuse the tank. Since it is authorized for video surveillance according to § 4 BDSG, it should be taken into account that this provision does not oblige it to publicly announce the storage period of recordings.
In addition, the defendant has not yet dealt with the granularity of recording and the limitation of evaluation on occasions. No specific people can be seen on the usual recordings, only dark and light shadows. An attempt would only be made to identify persons in the course of follow-up work on a specific occasion. The post-processing option is restricted to the managing director and one other representative.
It was violated in its general freedom of action according to Art. 2 Para. 1 GG and its right to the established and exercised commercial enterprise according to Art. 14 Para. 1 GG. The storage period it has undertaken is proportionate. The cameras used are so-called "Mobotix cameras", which can be controlled individually via a network storage device. Purchasing a new system is not economical and would cost around EUR 25,000.00. The defendant did not take this into account. It is also not apparent that the defendant is proceeding accordingly against other gas station operators. This violates the ban on arbitrariness enshrined in Article 3 of the Basic Law.
The cost order of the defendant is also unlawful. The costs claimed would be disputed overall in principle and in terms of amount.
The plaintiff requests
to annul the decision of the defendant of February 18, 2019 and the cost assessment decision of the same day.
The defendant requests
reject the complaint.
As justification, she essentially submits: The complaint is unfounded. First of all, there is no violation of the requirement of certainty. The decision at issue sets out sufficiently clearly in which cases data can be stored for more than 72 hours. It is clearly defined when a rule and when an exceptional case exists. The plaintiff can therefore see what behavior is required of her.
In accordance with Art. 58 (2) (f) GDPR, you have made an order that is free of discretionary errors in order to prevent a sustained violation of provisions of the GDPR. In principle, the plaintiff is authorized to record videos pursuant to Art. 6 (1) (f) GDPR. Contrary to the plaintiff's view, § 4 BDSG is not relevant due to the priority of application of the GDPR. Section 24 (1) no. 2 BDSG does not serve as a legal basis either. This provision covers cases in which data are processed for a purpose other than that for which the data were collected. Even if these provisions were applied, the storage period would still be unlawful, because it is not the performance of the video surveillance itself that is objected to, but the duration of the storage. With regard to the storage period, Section 17 GDPR is decisive. According to this, video recordings are to be deleted immediately as soon as the data are no longer required for the purposes for which they were collected. Exact time limits could not be found in the law. Rather, a case-by-case analysis must be carried out. In the case of the plaintiff, data storage for more than 72 hours is not necessary to achieve the purpose. She stated that the purpose of the video surveillance was to monitor theft, prevent vandalism and preserve evidence, for example in cases of property damage and fuel fraud. During normal business operations, the plaintiff is able to achieve these purposes within 72 hours. During this period, damage to property and theft could be determined, the video material viewed and relevant sequences possibly initially secured in accordance with Article 17(3)(e) GDPR.
Insofar as the plaintiff argued that a longer storage period was necessary in order to protect itself against claims from unjust enrichment, this could not be accepted. In the event that a dishonest customer disputes the payment process after completing the refueling and payment process and then claims a refund via §§ 812 ff. BGB, the plaintiff could not only provide evidence of the refueling process through the video recordings. The fact that the use of the card and entering the PIN to start the fueling process is a mandatory requirement shows that evidence can be provided by appropriate payment and debit receipts.
Even in constellations in which a customer claims that his card and PIN were stolen from him and that the thief did not carry out the fueling process himself, a longer storage period is not justified. In such constellations, the burden of proof for the unfaithful behavior of third parties does not lie with the plaintiff, but with the bank.
The constellation described by the plaintiff, that customers accidentally activated the wrong gas pump at first, was described by the plaintiff for the first time in the lawsuit. This submission was belated and could not be taken into account in the disputed decision. In addition, such cases did not justify a longer storage period. On the one hand, this constellation could be countered by technical precautions and, on the other hand, it is already questionable how often such cases would actually occur. These are probably exceptional situations which, in view of the interests and rights of the vast majority of those affected, do not justify a longer storage period.
Criminal law considerations also do not justify a longer storage period. Criminal prosecution is the task of the prosecution authorities and not a matter for the plaintiff. They are also not stopped to commit a criminal offense under Section 339 of the Criminal Code. If there are indications that a criminal offense has been committed, the recording can also be stored for more than 72 hours; On the other hand, deletion must take place if no relevant event could be viewed.
So far, the plaintiff has not provided any evidence that she could actually be held liable in the various constellations she has described or that there have been corresponding attempts against her in the past. However, it is obliged to do so according to the case law of the Federal Administrative Court (ruling of March 2nd, 2022 - 6 C 7.20 -, juris marginal note 49 f.).
The various guidelines and orientation aids cited by the plaintiff also do not justify a longer storage period. The "Guidelines 3/19 on processing of personal data through video devices" of the European Data Protection Authority only justify a storage period longer than 72 hours if there is a need, which must be specifically explained. Such a necessity is not recognizable in the case of the plaintiff. Insofar as the plaintiff referred to the BKA's recommendations for action on ATM demolitions, a comparability with self-service filling stations was not recognizable. In addition, a storage period of 72 hours is also recommended here. The minutes of the consultation of the banking working group of the data protection conference cited by the plaintiff, which was written with regard to video surveillance at banks and ATMs, should not be taken into account due to a lack of comparability. After all, at a self-service filling station, petrol and no money is issued. The guide to video surveillance by the Bavarian State Commissioner for Data Protection addresses a state law standard. This is not applicable. In addition, the permissible storage period is not determined by state law, but by the GDPR. The rules cited by the plaintiff "Scope of means of payment in sales outlets" of the German statutory accident insurance, central association, BGR/GUV-R141, did not contain any statements about different storage periods. These only express a recommendation/requirement for open video surveillance.
When determining the 72-hour storage period, it took into account that video surveillance primarily stored data from uninvolved parties, which neither gave rise to data storage nor had any influence on it. The rights of these persons can only be adequately safeguarded if the data is deleted immediately after the processing purpose has been achieved. To the extent that the plaintiff claims that people cannot be identified through the video surveillance, this is disputed. The recordings are sharp and clear on the images provided by the plaintiff. The defendant does not demand that the plaintiff purchase a new video surveillance system. Rather, the plaintiff could (or have) adjust the existing system with reasonable effort in compliance with data protection. After all, the instruction made does not suffer from any errors of discretion and is proportionate.
The plaintiff's submission on the signage is not relevant to the decision, since the disputed decision does not contain any instructions in this regard. However, it is correct that the plaintiff has to observe data protection obligations. The storage period is not a business secret within the meaning of the Business Secrets Act (GeschGehG).
For further details of the facts, reference is made to the content of the court file and the administrative process involved.
Reasons for decision
The lawsuit did not have any success. It is permissible but unfounded.
I. The complaint is unfounded. The disputed decision of February 18, 2019 (1.) and the cost assessment decision of the same day (2.) are lawful and do not violate the plaintiff's rights, § 113 Para. 1 Administrative Court Code (VwGO).
1. The decision of February 18, 2019 is lawful. The data protection restriction on the storage period (a), the request for confirmation (b) and the threat of fines (c) are not legally objectionable.
a) The order of the defendants to generally limit the recordings of the plaintiff's video surveillance to 72 hours is lawful.
aa) The legal basis for the disputed limitation on the storage duration of the video recordings is Article 58(2)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data , the free movement of data and the repeal of Directive 95/46/EC (General Data Protection Regulation; hereinafter: GDPR). Accordingly, the supervisory authority can impose a temporary or permanent restriction on processing, including a ban, which the defendant did with the limitation of the storage period of the video recording.
bb) There are no formal objections to the notification. The defendant is responsible for the issuance of the notice pursuant to §§ 19 Paragraph 1, 22 Paragraph 1 No. 1 Lower Saxony Data Protection Act (NDSG). Prior to its enactment, the plaintiff was sufficiently heard in accordance with Section 1 (1) of the Lower Saxony Administrative Procedures Act (NVwVfG) in conjunction with Section 28 (1) of the Administrative Procedures Act (VwVfG) and the decision is also sufficiently specific in accordance with Section 1 (1) of the NVwVfG in conjunction with Section 37 (1) of the VwVfG .
According to Section 37 (1) VwVfG, the content of an administrative act must be sufficiently specific. An administrative act is sufficiently defined in terms of content if the content of the regulation made by the authority is so completely, clearly and unambiguously recognizable for those involved, in particular for the addressees of the administrative act, that they can adjust their behavior accordingly, and if the decision is also suitable to be the basis for measures of compulsory enforcement (Tegethoff, in: Kopp/Schenke, VwVfG, 23rd edition, § 37 para. 5). This is the case here. Based on the wording, taking into account the other circumstances of the individual case and in good faith through interpretation, it can be inferred from the decision that the plaintiff is fundamentally prohibited from storing video recordings for longer than 72 hours.
Contrary to what the plaintiff believes, the regulation is not vague because it remains unclear in which cases it is entitled to storage longer than 72 hours. It can be unequivocally inferred from the disputed decision that a longer storage period is permissible in the event of absences on public holidays. The defendant has also explained that longer storage is possible in cases in which the recording material is necessary to clarify cases of damage or to enforce any claims that the plaintiff would like to assert itself or against which it has to defend itself.
cc) The decision is also materially lawful. The plaintiff's data processing, which the defendant complained about, is unlawful. There is therefore reason for the defendant to intervene. It was carried out for the purpose of ending a situation that violated data protection law, since the recordings of the video surveillance were previously stored for six to eight weeks and thus - in violation of data protection law - too long.
The video surveillance carried out by the plaintiff and the storage of the data obtained in the process are subject to the regulatory regime of the GDPR (1). The purposes for which the plaintiff is then allowed to carry out the video surveillance (2) do not generally justify a longer storage period than 72 hours (3). Finally, the defendant ordered the limitation of the storage period under data protection law without any errors of discretion (4.).
(1) The video surveillance carried out by the plaintiff and the storage of the data obtained in the process are subject to the regulatory regime of the GDPR. Contrary to what the plaintiff says, she cannot base the video surveillance and storage on § 4 BDSG. This provision is contrary to Union law insofar as it affects both public and non-public bodies. Art. 6 (1) (e) and (3) GDPR only gives the member states scope for regulation insofar as video surveillance involves the performance of a task that is in the public interest or is carried out in the exercise of official authority. This means that the first alternative of Section 4 (1) BDSG (performance of tasks by public bodies) can be included under the opening clause of Article 6 (1) (e) and (3) GDPR. In addition, however, § 4 Para. 1 BDSG - contrary to Union law - also allows video surveillance to exercise domiciliary rights (Paragraph 1 No. 2) or to protect legitimate interests (Paragraph 1 No. 3) and this for public bodies as well as for non-public bodies. However, this leaves the permissible reason for the opening clause, so that due to the priority of EU law, Section 4 BDSG must be disregarded here (such as Buchner, in: Kühling/Buchner, GDPR and BDSG, 3rd edition, BDSG, Section 4 para 3).
In an obiter dictum on March 27, 2019, the Federal Administrative Court also spoke out against the application of § 4 BDSG for video surveillance by non-public bodies and determined that video surveillance by private persons responsible according to Art. 6 Para. 1 S. 1 lit. f) GDPR (- 6 C 2.18 -, juris). Insofar as the plaintiff believes that this decision does not apply to the present case because it refers to an outdated legal situation, it must be countered that the Federal Administrative Court expressly referred in its decision to the future legal situation after the GDPR came into force ( Judgment of 03/27/2019 - 6 C 2.18 -, juris para. 41 ff.). As a result, the data protection conference also assumes in its orientation guide on video surveillance for non-public bodies that Section 4 BDSG does not apply to video surveillance by non-public bodies, but that Article 6 (1) sentence 1 lit. f) GDPR applies (available at : 20200903_oh_vü_dsk.pdf (datenschutzkonferenz-online.de), p. 7 fn. 8, last accessed on: 03/17/2023). Insofar as the plaintiff believes that § 4 BDSG applies to her because she sells fuel and thus performs a public task within the framework of services of general interest, this is not to be agreed. The standard is expressly only to be applied to public bodies. The plaintiff is - even if it were to perform public tasks - but undisputedly a private company.
The plaintiff cannot base the video surveillance and the storage of the data obtained thereby on § 24 BDSG. This provision covers those cases where data is processed for a purpose other than that for which the data was collected. The plaintiff did not name such a different purpose and it is otherwise not recognizable.
(2) Pursuant to Art. 6 (1) (f) GDPR, the plaintiff is entitled to video surveillance, but she is not allowed to carry it out for all of the purposes she has put forward. Insofar as she stated that she also uses video surveillance to enforce or defend against claims under civil law, she has not been able to substantiate and prove that she has a legitimate interest in carrying out video surveillance for precisely this purpose.
According to Art. 6 (1) lit. f) GDPR, the processing of personal data is only lawful if the processing is necessary to protect the legitimate interests of the person responsible or a third party, unless the interests or fundamental rights or fundamental freedoms of the data subjects who protect require personal data, especially when the data subject is a child.
Any legal, factual, economic or non-material interest of the person responsible may be regarded as justified, insofar as it is not disapproved of by the legal system. The legitimate interest must be directed towards a specific purpose of processing or use. The interest is therefore only justified if the processing is legitimate and lawful (Taeger, in Taeger/Gabel, DSGVO - BDSG - TTDSG, 4th edition 2022, Art. 6 para. 129). The legitimate interest of the person responsible must be substantiated and documented (Taeger, in Taeger/Gabel, GDPR - BDSG - TTDSG, 4th edition 2022, Art. 6 para. 135; cf. also BVerwG, ruling of 02.03 .2022 - 6 C 7/20 -, juris para. 50). This special substantiation is only not required if there is a situation which, according to general life experience, is typically dangerous and requires monitoring. Such an abstract risk situation is assumed, for example, in shopping centers and department stores (cf. on the old legal situation Nds. OVG, judgment of September 29, 2014 - 11 LC 114/13 -, NJW 2015, 502, 505 marginal number 44; cf. on applicability of these principles also in the scope of the GDPR Taeger, in Taeger/Gabel, GDPR - BDSG - TTDSG, 4th edition 2022, Art. 6 para. 135).
The plaintiff - this has also been recognized by the defendant - is entitled, after applying these principles, to carry out video surveillance to prevent and track criminal offenses, in particular vandalism and damage to property. The self-service filling station operated by the plaintiff is a potentially high-risk facility based on general life experience, which is typically the victim of vandalism and damage to property, so that the plaintiff does not have to specifically prove her legitimate interest in the video recording in this regard.
Insofar as the plaintiff has also argued that the video surveillance also serves to protect itself against unjustified claims under civil law and to be able to enforce such claims itself, it is not allowed to carry out the video surveillance for this purpose. She has neither substantiated nor proven a legitimate interest in data collection for these purposes.
First of all, it should be noted that enforcing the purchase price claim and defending against civil law claims by a possible fuel fraudster at a self-service filling station does not represent a situation in which, based on general life experience, it can be assumed that it typically occurs regularly. According to the principles described above, the plaintiff is obliged to present and prove its legitimate interest in data collection and processing. She failed to do so in this case.
Video recording is not required to enforce purchase price claims according to § 433 BGB because the self-service filling station operated by the plaintiff only dispenses petrol when the petrol pump has been activated. Activation takes place by introducing the accepted payment cards using a PIN. As soon as the nozzle is put back in place, the customer's account is debited directly. In principle, customers cannot leave the gas station without initiating the payment process.
Insofar as the plaintiff explained that her gas station also accepts specially issued fuel cards that are billed monthly via a SEPA direct debit procedure, this also does not entitle him to video surveillance. In this regard, the plaintiff stated that customers can object to the collection of the invoice amount from their bank without giving reasons and that the banks are then partially entitled under the contractual agreements to reverse the amount paid out to the plaintiff. However, the plaintiff is not dependent on the recordings of the video surveillance system to enforce the purchase price claim. Ultimately, they can provide evidence of the fueling process (which forms the basis of the purchase contract) simply by using the personalized fuel card using a PIN at their self-service fuel station. This is verifiable via the billing documents. Finally, the plaintiff has not provided a single piece of evidence that such a case has occurred in the past. Prior to the oral hearing, the court asked the plaintiff to submit the relevant documents. The plaintiff did not comply with this - even during the oral hearing. As far as the plaintiff's managing director explained in this regard, receipts and proof could not be submitted because in the past such cases could always have been clarified by the fact that he alone had looked at the video recordings and was able to assure his counterpart on the telephone that the refueling process took place, the Chamber considers this to be remote and unconvincing. It does not correspond to general life experience that any legal claims can always only be presented by telephone and then finally clarified by telephone.
The plaintiff is also not allowed to carry out the video surveillance for the purpose of defending against civil claims according to §§ 812 ff. BGB. In this regard, she claimed that in the past there had been cases in which a customer's card had been debited after a refueling process and the customer then claimed that he had not refueled his vehicle with the plaintiff and had therefore reclaimed the purchase price. It would therefore be in the room that the plaintiff obtained the purchase price through the customer's performance without any legal reason. Even if such cases have occurred in the past, the Chamber believes that they do not justify video surveillance. According to the rules on the burden of proof under civil law, the alleged customer would initially be burdened with proof for the lack of a legal basis, i.e. for the fact that no sales contract came about between him and the plaintiff - i.e. that no refueling process was carried out (cf., for example, Wendehorst, in BeckOK BGB , 65th ed., § 812, Rn. 281f.). In addition, in such constellations, the plaintiff can in principle provide proof of the refueling process and thus the existence of a legal basis via the bills. Insofar as the plaintiff has stated in this regard, without submitting appropriate evidence, that the customer's full IBAN is not shown on the statements, the Chamber is convinced that the IBAN and therefore the identity of the respective card user can be determined from the information on the statement can be determined by research measures at the bank. In addition, the plaintiff has not provided a single piece of evidence for this constellation that such cases have actually occurred in the past. In this regard, too, the Chamber considers it far-fetched for customers to attempt to verbally enforce their supposed legal claims and then refrain from pursuing the case because of information given over the telephone, which is based on viewing the video material that the customer cannot understand.
The plaintiff is also not entitled to video surveillance for the constellation put forward by the plaintiff, that customers had claimed in the past that their card and PIN had been stolen and used for refuelling. In such constellations, the burden of proof for the unfaithful behavior of third parties does not lie with the plaintiff, but generally with the credit institutions according to §§ 675 v -675 w BGB. § 675 v BGB is the central liability standard in the legal relationship between payment service provider and payment service user. It regulates which party has to bear the damage caused by unauthorized third parties in the event of misuse of payment services. A liability of the payee is not intended here. § 675 w BGB regulates the burden of proof and also does not refer to the payee. In addition, when using an EC card/Visa card with a PIN - and only such cards can be used by the plaintiff according to her own submission - there is basically a payment guarantee from the credit company. Finally, with regard to this alleged constellation, the plaintiff did not succeed in substantiating a dangerous situation. Despite a court order, she has not provided any evidence that such cases have occurred in the past.
The plaintiff further argued that it was dependent on video surveillance in order to be able to clarify cases in which customers complained that their card had been charged twice after incorrect operation. In the past, there have been cases in which customers have activated the wrong petrol pump through the central terminal and then the correct one. Another customer then refueled at the pump, which he accidentally activated, at the expense of this customer. This lecture also does not justify video surveillance. First of all, the Chamber is convinced that such cases can be countered with technical devices, so that they do not have to occur at all. In addition, with regard to this case constellation, the plaintiff has not presented any reliable evidence that it actually occurred in the past.
Insofar as the plaintiff finally claimed that she was dependent on video surveillance because she had to be able to defend herself against criminal charges because of the allegedly incorrect debiting of payment cards, she was also unable to substantiate in this regard that in the past criminal law against it was determined or criminal proceedings were even instituted. The Chamber considers it absurd that there is no written evidence of such a constellation.
(3) Insofar as the plaintiff is entitled to carry out the video surveillance, the recordings obtained in this way may not be stored for longer than 72 hours.
According to Art. 5 (1) lit. c) and e) GDPR, personal data may not be stored for longer than is necessary for the purposes for which it was processed (principles of data minimization and storage limitation). Conversely, Art. 17 (1) (a) GDPR stipulates that personal data must be deleted immediately if they are no longer necessary for the purposes for which they were collected. The plaintiff is currently not complying with this.
The permissible purpose of video surveillance is to prevent and track criminal offenses, in particular vandalism and damage to property. For this purpose, the plaintiff is entitled to collect and store images. However, it is not necessary to keep these records for six to eight weeks to achieve the purpose.
When data is no longer necessary to fulfill the purpose cannot be determined in general. An examination in individual cases is required (Herbst, in: Kühling/Buschner, GDPR and BDSG, 3rd edition, Art. 17 para. 17). However, some general principles can be identified. In most cases, the personal data should be automatically deleted after a few days, taking into account the principles of Article 5 (1) (c) and (e) GDPR. The longer the storage period, the greater the need for arguments in relation to the legality of the purpose and necessity. This applies in particular if it is more than 72 hours (European Data Protection Board, Guidelines 3/2019 on the processing of personal data by video devices, 01/29/2020, p. 30). Measured against these requirements, it can be determined that the six to eight-week duration of storage is not necessary here.
It is easily possible to determine within 72 hours whether vandalism or damage has occurred at the plaintiff's gas station and, should this be the case, then to view the video material. If the video material then provides further information on a criminal act, the plaintiff is entitled to longer storage (cf. Art. 17 Para. 3 lit e) GDPR). Contrary to what she has argued, the plaintiff does not see herself as being accused of frustrating criminal prosecution under Section 339 of the Criminal Code, apart from the fact that she is already an unfit offender under the criminal law. These are only judges, other public officials (§ 11 Para. 1 No. 2 StGB) or arbitrators (§ 1025 Code of Civil Procedure (ZPO), § 101 Labor Court Act (ArbGG), § 76 Book Ten of the Social Code (SGB IX), § 168 Para. 1 No. 5 VwGO). The order of the defendant regarding the storage period also does not stop the plaintiff from destroying evidence. As a rule, cases of property damage/vandalism should be noticed within 72 hours; if the video material then provides further information on a crime, it is entitled to store it for a longer period of time. If, as an exception, evidence is to be deleted, the necessary intent to frustrate the criminal prosecution is likely to be lacking.
The entitlement to a longer storage period cannot be justified even by using the various sources, guidelines, orientation aids and information cited by the plaintiff.
Such an approach cannot initially be achieved by applying the "Guidelines 3/19 on processing personal data through video devices" of the European data protection supervisory authority cited by the plaintiff (available at: edpb_guidelines_201903_video_devices_en_0.pdf (europa.eu), last accessed on: 03/22/2023 ) for the plaintiff.
Paragraph 121 on page 28 states the storage period for video recordings:
"The longer the storage period set (especially when beyond 72 hours), the more argumentation for the legitimacy of the purpose and the necessity of storage has to be provided."
The European data protection supervisory authority also generally assumes a permissible storage period of 72 hours. A storage period that goes beyond this is possible, but requires a necessity that requires particular justification. With regard to the clarification of cases of vandalism and damage to property, the plaintiff has not succeeded in presenting a comprehensible reason why it should not be possible to determine corresponding incidents within 72 hours and to view the data material to that effect.
The plaintiff further relies on the BKA's recommendation for action on ATM demolitions (V.n.b.). She herself states that the BKA stipulates a minimum storage period of 72 hours in appropriate cases. According to its own statement, the BKA does not recommend regular, longer storage periods. In addition, the Chamber cannot see to what extent these cases can be compared with incidents at a self-service filling station. The BKA states the following on its homepage regarding ATM blasts (available at: BKA - ATM blasting, last accessed on March 22, 2023):
"ATMs are repeatedly the target of physical attacks by criminals because of the cash they contain. In addition to technical devices such as cutting torches, angle grinders, hydraulic spreaders or lever tools, the perpetrators also use gas mixtures and explosives to blast open the ATMs. While in the past they used to blow them up gas mixtures were used, which were fed into the machines and ignited, the perpetrators now mainly use solid explosives (e.g. flash bangers, home-made devices).
This is the most common way for ATMs to be attacked in remote locations and at times when there is typically little or no customer activity. Nevertheless, these acts also endanger the life and limb of residents and passers-by: On the one hand, the perpetrators cannot assess the dangers emanating from debris and splinters. On the other hand, the perpetrators often show ruthless escape behavior. They usually use highly motorized vehicles and can significantly endanger third parties and police forces.
Attacks on ATMs of this kind generally fulfill the elements of Section 308 of the Criminal Code (causing an explosive device explosion) in conjunction with Section 243 of the Criminal Code (particularly serious case of theft)."
Both with regard to the seriousness of the criminal offenses involved in ATM blasts and with regard to the endangerment of third parties through such cases, there is absolutely no comparability with the plaintiff's trade.
The plaintiff also refers to the minutes of the consultation of the banking working group of the data protection conference with regard to video surveillance at banks or an ATM (V.n.b.), according to which storage periods of up to 142 days are permissible. In this regard, the plaintiff submits that the data protection conference recognized with regard to banks and ATMs that the civil law statute of limitations can be taken into account with regard to the storage period. In this regard, she also refers to an information letter from the Hessian Commissioner for Data Protection and Freedom of Information (V.n.b.), in which he summarizes the view of the data protection conference for video surveillance in banks and regarding ATMs. Since the plaintiff is not entitled to carry out video surveillance for the purpose of enforcing and defending against civil law claims (cf. the statements under (2)), the statements of the data protection conference with regard to the civil law statute of limitations are not applicable to the present case. Incidentally, it also applies here that there is no comparability between banks and ATMs with the present case of a self-service gas station.
From the 29th Activity Report Data Protection 2020 cited by the plaintiff (available at: State Parliament of the Saarland - So16_1560.pdf (landtag-saar.de), last accessed on: 22.03.2023) of the State Commissioner for Data Protection and Freedom of Information of the Saarland, the The plaintiff also does not derive any authorization to store their video recordings for a longer period of time. The plaintiff refers here to the statements on banks (p. 99 f.). Here too, however, a short storage period is generally advocated. That's what it says below
"3.18.1 Video surveillance in banks
The standard deletion period for video surveillance is generally 48 to 72 hours.
Although this paper also considers a longer storage period to be permissible for various areas in banks, the corresponding case constellations are also not comparable with the present case - if only because the typical risk situation in banks is to be assessed differently. Insofar as the plaintiff refers to the statements on the storage period in the area of ATMs with regard to this report - a storage period of 142 days is recommended here - the Saarland data protection officer justifies this long storage period with the applicable reversal of the burden of proof at the expense of the credit institutions, according to which the credit institution in the event of contesting must prove that the customer made a transaction at the ATM. Against this background, he considers a storage period based on the three-month period in which a transaction can be denied to be acceptable. In the present case, however, the plaintiff cannot invoke such a reversal of the burden of proof - in particular with regard to the purpose for which it is only allowed to carry out the video recording.
The guide quoted by the plaintiff "Video surveillance by Bavarian public bodies" from the Bavarian State Commissioner for Data Protection (available at: Video surveillance by Bavarian public bodies - Explanations on Article 24 of the Bavarian Data Protection Act (datenschutz-bayern.de), last accessed on March 22, 2023) , is not to be used for the present case because the explanations relate to video surveillance by "public bodies" and the plaintiff is undisputedly not such. In addition, the treatise is written on a Bavarian state standard that is not applied.
As far as the plaintiff finally refers to the paper "Handling means of payment in sales outlets" of the German statutory accident insurance, central association, BGR/GUV-R141 (available under: 108-001.pdf (uv-bund-bahn.de), last accessed on 22.03 .2023), no statement on storage periods of data material can be derived from this document. Point 5.2.26 on page 16 only advocates the implementation of open video surveillance.
The plaintiff also refers to the judgment of the Lower Saxony Higher Administrative Court of September 29, 2014 (- 11 LC 114/13 -, juris), in which a storage period of ten days was considered permissible for video recordings. The plaintiff cannot derive any entitlement to a longer storage period from this decision. First of all, it should be noted that the Higher Administrative Court of Lower Saxony has not stipulated a generally applicable storage period, but made an individual decision based on the specific circumstances of the case. The circumstances of the case are not comparable to those in the plaintiff's case. The plaintiff in the proceedings before the Lower Saxony Higher Administrative Court was the owner and administrator of a multi-storey office building. In the opinion of the court, she was entitled to carry out video surveillance for the purpose of preventing criminal offenses and securing evidence for the investigation of criminal offenses committed because, among other things, she had explained in a comprehensible manner that several valuable notebooks had recently been taken from the offices of the tax consultancy company located in the building and pallets stored there had been stolen from the basement. The plaintiff had also explained in a comprehensible manner that the employees who were employed in the individual law firms and practices in the plaintiff's office building were often absent for work-related reasons, so that the corresponding criminal offenses could only be determined within ten days. The plaintiff was not able to provide a corresponding explanation in the present proceedings. Rather, she failed to provide any explanation as to why she - apart from public holidays or vacation-related absences - should not be able to determine within 72 hours whether there was vandalism or damage to property at the self-service filling station she operates.
Finally, the plaintiff does not get through with her argument that she is obliged to announce the storage period of the video recordings on signs and that she is thereby forced to encourage people to cheat on fuel tanks. The first objection to this is that the disputed decision by the defendant does not contain any information on signage. The statements of the plaintiff on this point are therefore not the subject of the present proceedings. The obligation to post information also results from the law, more precisely from Art. 13 Para. 2 lit a) GDPR. According to this, there is an obligation to indicate the period for which the personal data will be stored or, if this is not possible, the criteria for determining this period. This applies regardless of how long the storage period is. So if the purpose of the storage does not justify a longer storage period, no longer storage period can be justified by the notification obligation. The plaintiff was therefore already obliged to provide a corresponding notice in the past, independently of the disputed decision.
(4) The restriction order of the defendant was issued without errors of judgement. In particular, it is proportionate. The order to limit the storage period of the video recordings made by the plaintiff serves the legitimate purpose of creating a data protection-compliant situation. It is also suitable for creating this state. There is also a requirement. A milder, equally effective means was not available for the defendant, after the plaintiff had already indicated in the administrative procedure that it was sticking to its legal opinion that it was entitled to a longer storage period. Finally, the arrangement is also appropriate, i.e. proportionate in the narrower sense. Contrary to the plaintiff's submission, the defendant initially did not set a standard period, but sufficiently addressed the special features of the individual case. She determined this in an extensive administrative procedure and went into detail about the purposes put forward by the plaintiff for the storage period. A violation of the ban on arbitrariness set out in Article 3(1) of the Basic Law is not apparent. The defendant was not required to take equal action against all local petrol stations. Rather, it has to examine the circumstances of each individual case with regard to each filling station. Various aspects that cannot be generalized - for example whether it is a "normal" or a self-service petrol station, the opening hours of the respective establishment, the number of employees, the frequentation of customers, etc. - will have to be taken into account. A violation of the general freedom of action according to Art. 2 Para. 1 GG is not evident. Rather, an intervention in this is justified after the requirements of Article 17 (1) (a) GDPR are met. There is also no unjustified encroachment on the plaintiff's right to the established and exercised commercial enterprise pursuant to Article 14(1) of the Basic Law. The conflicting interests of those affected in prompt deletion of their data, who can invoke their right to informational self-determination (Article 2(1) of the Basic Law), outweigh the plaintiff's interest in being able to store the recordings regularly for longer than 72 hours. Within 72 hours, the plaintiff can regularly determine facts that require clarification and, if there are actual indications, further investigate them using the video recordings. A regular, longer storage period interferes with the informational self-determination right of the recorded persons for a disproportionately long time. It should be noted that these persons did not give any reason for the recording. The Chamber considers the plaintiff's statements that the resolution of her recordings is so bad that people are basically not recognizable to be dubious and otherwise irrelevant because it is apparently possible for her managing director to edit the recordings without great effort in such a way that a recognizability can be established. Finally, in the context of the consideration, it can be assumed that the plaintiff is able, with a manageable effort, to adjust its system in such a way that the storage period for recordings is usually only 72 hours. Purchasing a new system should not be necessary. Even if so, the acquisition costs should not be so high that proportionality would be denied. According to her statements in the oral hearing, the plaintiff herself has not yet dealt with the concrete expected costs of changing the storage period.
b) The defendant's request to confirm the implementation of the storage limitation is also not objectionable. It is based on Art. 58 Para. 1 lit a) GDPR. According to this, each supervisory authority has all the investigative powers that allow it to order the controller, the processor and, where applicable, the representative of the controller or the processor to provide all the information necessary for the performance of their tasks. According to Art. 57 Para. 1 lit a) GDPR, the tasks also include monitoring and enforcing the application of the GDPR.
c) The threat of fines in the amount of EUR 1,000.00 made in the disputed decision also does not raise any legal doubts. The threat of fines can be based on Section 70 of the Lower Saxony Police and Regulatory Authorities Act (NPOG) in conjunction with Sections 65 (1) No. 2 and 67 NPOG. The factual requirements of the legal basis are in place. Furthermore, it is not apparent that the threat would be unlawful.
2. The cost assessment decision of February 18, 2019 is also not objectionable.
The cost assessment decision is based on §§ 1, 3 and 5 Lower Saxony Administrative Costs Act (NVwKostG) in conjunction with number 1.11 of the cost tariff for § 1 Ordinance on Fees and Expenses for Official Acts and Services (AllGO). Accordingly, costs can be settled in the amount of the time spent. Specifically, 15 hours were charged at EUR 15.75 per quarter of an hour or part thereof. The plaintiff denies the amount of the costs as a lump sum. However, it is not apparent that this approach could be exaggerated. Rather, the defendant presented their workload in tabular form (cf. Bl. 25 of the GA). There are no indications that she could have given false information here.
II. The decision on costs follows from Section 154 (1) VwGO. The decision on the provisional enforceability is based on § 167 VwGO in conjunction with § 708 No. 11 and § 711 sentence 1 and 2 ZPO.
