VGH München - 5 ZB 23.1778

VGH München - 5 ZB 23.1778
Court:	VGH München (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 6(1)(f) GDPR Article 57 GDPR Article 58 GDPR
Decided:	12.09.2025
Published:
Parties:	Data Subject versus B. GmbH (a private security company responsible for security operations at a shopping centre in Bavaria)
National Case Number/Name:	5 ZB 23.1778
European Case Law Identifier:
Appeal from:	VG Ansbach (Germany) AN 14 K 21.1365
Appeal to:	Unknown
Original Language(s):	German
Original Source:	Rewis (in German)
Initial Contributor:	Shravan

A court found that a shopping center’s security guard lawfully recorded a data subject who was causing trouble in the shopping center. The recording could be based on a legitimate interest.

English Summary

Facts

The controller is a private security company providing security services at a shopping centre in Bavaria.

In January 2021, a security guard working for the controller asked multiple times the data subject to leave the seating area owned by the controller. The situation became tense, to the point that the police was called.

In 26 July 2021, the data subject lodged a complaint with the Data Protection Authority (Bavarian Data Protection Authority - LfD Bayern) against the controller, alleging that the security guard started recording him without his consent with his body-worn camera. According to the data subject this constituted unlawful processing of personal data under the GDPR.

The controller explained that the guard activated the camera only after the data subject repeatedly refused to leave a restricted seating area, that the recording was communicated to the data subject, that a red indicator light signaled recording, and that the footage was deleted once its purpose of identifying the individual for possible civil action had been fulfilled.

The DPA held that it was no longer possible to clarify whether the data subject had been aggressive or whether the bodycam had only been activated after the announcement. The DPA therefore assumed that the security guard had acted in accordance with its operational policy. It decided to rejected the complaint, finding that the recording was justified under Article 6(1)(f) GDPR as necessary for the controller’s legitimate interests of protecting property and ensuring safety.

The data subject then appealed the decision of the DPA before the court of first instance (Administrative Court of Ansbach - VG Ansbach).

The court upheld the DPA’s decision, holding that the DPA had sufficiently investigated the matter and properly exercised its discretion under Articles 57 and 58 GDPR. It found no violation of the GDPR, noting that the processing was proportionate and limited to a specific incident.

The data subject appealed again the decision of the court of first instance before the court of appeal (Administrative Court of Munich - VGH München) arguing that he was not informed about the recording, that the DPA’s investigation had been inadequate and that corrective action should have been ordered despite uncertainty over the lawfulness of the recording.

Holding

The Court dismissed the appeal, finding no basis to reopen the case or question the DPA’s assessment. The Court held that the use of a body-worn camera by the controller's private security guard was lawful under Article 6(1)(f) GDPR, as it served legitimate interests in protecting property, maintaining order, and ensuring staff safety. The recording was held to be proportionate, limited to a specific instance of confrontation, and was accompanied by visible notice through an activated red light.

The Court further held that the DPA had lawfully exercised its discretion under Articles 57 and 58 GDPR, having adequately investigated the complaint and finding that no infringement occurred. The DPA was not required to impose corrective measures where a violation could not be established. Accordingly, the appeal was dismissed, and no procedural or investigative failings were found.

Comment

The judgment reaffirms that the use of body-worn cameras does not breach Article 6(1)(f) GDPR when the processing serves a legitimate purpose such as property protection, and when the scope and duration of surveillance remain proportionate to that purpose.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the German original. Please refer to the German original for more details.

VGH Munich, decision of September 12, 2025 – 5 ZB 23.1778
Title:
Administrative Courts, Legitimate Interest, User Agreements, GDPR, Inevitableness,
Exercise of Dwelling Rights, Bodycam, Discharge of Residual Debt, Right to Redress,
General Data Protection Regulation, Supervisory Authority, Determination of the Value in Dispute, General Decree,
Testimony Against Testimony, Extension of Time to File, Oral Hearing, Liability,
Administrative Court Judgments, Supervisory Measures, Cost Decision
Keywords:
Bodycam Use, Data Protection Supervision, Dwelling Rights, Video Recording, Aggressive Behavior,
Information Obligations, Administrative Procedure
Lower Court:
VG Ansbach, Judgment of April 25, 2023 – AN 14 K 21.1365
Source:
BeckRS 2025, 25660
Opinion
I. The plaintiff's application for leave to appeal against the judgment of the Ansbach Administrative Court's decision
of April 25, 2023 – AN 14 K 21.01365 – is dismissed.
II. The plaintiff shall bear the costs of the admission proceedings.
III. In amendment of No. 3 of the Administrative Court's decision of April 25, 2023, the
value in dispute for both instances is set at €5,000 each.
Reasons
I.
1
The plaintiff objects to the termination of an appeal procedure by the defendant State Office
for Data Protection Supervision and requests its action regarding an incident in which he was filmed with the body camera of a private security guard.
2
In his letter of complaint dated February 27, 2021, to the defendant, the plaintiff described that on
January 13, 2021, Mr. K., the security employee of B. GmbH, had evicted him from a bench in the shopping center operated by the company, where he had wanted to eat a doner kebab.
He immediately complied and then went to an outdoor bench that bore no markings and was recognizable as a public seat. Mr.
K., in turn, had attempted to evict him, citing his house rules, and when he failed to comply, switched on his bodycam without further notice and filmed him eating on the bench.
3
The defendant requested B. GmbH to respond to the plaintiff's allegations and to respond to eight further questions concerning the circumstances of the company's use of bodycams.
4
In the subsequent statement from B. GmbH dated April 7, 2021, which included a statement from
Mr. K., the managing director of the security service contracted by B. GmbH, it was
stated that the plaintiff's descriptions were incorrect. The request to leave the entire premises
was made after a lengthy discussion and lack of understanding, and the plaintiff only went outside after
repeated requests. The bench on which he then sat was also located within the shopping center's domestic rights. After further unsuccessful requests
and loud, lacking understanding, and abusive behavior from the plaintiff, he was informed
that the body camera would be activated to preserve evidence for further enforcement. Since the plaintiff
did not disclose his personal details to pursue civil action, the police were called, but they only arrived after the plaintiff had left. On January 20, 2021, the plaintiff
ate another kebab on the outdoor bench; after unsuccessful requests to leave the premises, the police were called and his personal details were recorded. According to the regulations, the body cameras are not activated without prior notice, as was the case here as well. Activation
was clearly recognizable by a flashing red light. The plaintiff's recordings had since been deleted because their purpose—establishing his personal details—had been fulfilled by the police intervention on January 20, 2021. The security company's operational concept for the use of body cameras was attached to the statement.
5
The defendant informed the plaintiff in a so-called final statement dated July 13, 2021, that after examining the facts of the case, no supervisory measures would be taken because, after evaluating the submitted statement, there were no indications of a data protection violation. It can no longer be clarified
whether the bodycam was only activated after the notification.
6
With the lawsuit filed on July 26, 2021, the plaintiff seeks an order requiring the defendant to take data protection supervisory measures against the responsible body. By judgment of April 25, 2023, served on the plaintiff on September 6, 2023, the lawsuit was dismissed on the grounds that a violation of data protection provisions could not be established and could not be established. It could not be established that the data processing in the form of the video recording violated Article 6 (1) (f) GDPR in conjunction with the so-called
guidance of the data protection supervisory authorities affiliated to the Data Protection Conference (as of February 22, 2019). Assuming the truth of B. GmbH's allegations, the recording was carried out with a legitimate interest. The defendant assumed that it was not possible to determine whether the plaintiff had been aggressive using appropriate investigative methods. The memorandum from Police Station A. dated January 20, 2021, which also mentions the events of January 13, 2021, was inconclusive regarding the question of aggressiveness. Further investigation options were not available and do not exist; only the conflicting statements were confronted. It also cannot be determined that, at least at the time of the recording, a violation of B. GmbH's house rules no longer existed. The municipal general order under infection control law cited by the plaintiff does not make any statement about the scope of the house rules; the provisions of the general order may override them, but exist independently. The 1997 user agreement between the city and the then operator of the shopping center regarding the outdoor area in question, presented at the oral hearing, shows that B. GmbH also has the right to use the property there. Whether the security guard had previously informed the court of the activation of the body camera in accordance with the regulations could not be determined using reasonable investigative methods. In this respect, it is a case of one person's word against another. However, it must be assumed that, in accordance with the orientation guide and the security concept, the red light on the body camera flashed during the recording. Upon inquiry from the defendant, the person responsible stated that the information sheet was available and would be handed out if possible. The plaintiff did not claim that it had not been offered to him. Therefore, the court assumes that the security guard acted in accordance with its operational concept. Furthermore, further clarification in this regard would probably no longer be promising due to the passage of time. 7
With the application for leave to appeal, filed on time on October 4, 2023, and substantiated on November 4, 2023, the plaintiff continues to pursue his request.
8
The defendant opposes the application for leave to appeal.
9
For further details, reference is made to the court and administrative files.
II.
10
The application for leave to appeal is unsuccessful. The grounds for leave to appeal asserted have not been
sufficiently explained (cf. Section 124a (4) Sentence 4 of the Code of Administrative Court Procedure (VwGO)) and are in any event not present.
11
1. There are no serious doubts about the correctness of the administrative court judgments (Section 124 (2) No. 1 of the Code of Administrative Court Procedure (VwGO). The plaintiff has not challenged any single fundamental legal principle or any significant factual findings of the administrative court with coherent counterarguments (on this standard, see Federal Constitutional Court, BVerfG, Bv. June 18, 2019 – 1 BvR 587/17 – BVerfGE 151, 173 para. 32 with further references).
12
a) The plaintiff argues that the area in which he was filmed was not subject to the controller's right of trespassing and thus no legitimate interest existed. The relevant bench is to be considered public space solely due to its appearance. Legally, the operator of the shopping center also did not have a right of trespassing because the bench is located in the area of the thoroughfare that leads from the city center over the bridge past the main entrance and the forecourt of the shopping center into the public area. Public use there overrides the private law powers; The public dedication of the sidewalks was stated in clause 9 of the contract and had been overlooked by the Administrative Court. The distinction made between through traffic and staying was therefore not convincing. Clause 1 of the contract stipulated that the public area was to be kept open at all times. The scope of the city's general order on infection control also contradicted the applicability of house rules there. The defendant had insufficiently clarified the facts; an attempt should have been made to determine whether he had actually been aggressive. If his non-aggressive behavior had been established, the recording would not have been permissible. The recordings could have been viewed until they were destroyed. The persons who had seen the recording could have been questioned. The aggressiveness of a person sitting and eating could only be imagined as a fabricated assumption. The Administrative Court assumed the aggressive behavior; According to the police report of January 20, 2021, which also addresses the events of January 13, 2021, the witness interrogation explicitly does not mention aggressive behavior. Furthermore, the manner in which the filming was conducted was unlawful. In particular, he was not offered an information sheet to hand out; here, too, neither the defendant nor the court investigated. There was no indication of the filming. The information required under Articles 15 et seq. of the GDPR was not provided, even though a request for deletion and information was immediately submitted.
13
b) This argument does not raise serious doubts about the correctness of the judgment.
14
According to Article 78(1) GDPR, every natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. The courts have unlimited jurisdiction in this regard, which includes the right to examine all questions of fact and law relevant to the dispute before them (ECJ, judgment of 12 January 2023 – Nemzeti Adatvédelmi és Információszabadság Hatóság, C-132/21 –
ECLI:ECLI:EU:C:2023:2 = juris para. 41). A legally binding decision by a supervisory authority is subject to a full substantive review (ECJ, judgment of December 7, 2023 – SCHUFA Holding
[Residual Debt Discharge], C-26/22 and C-64/22 – ECLI:ECLI:EU:C:2023:958 = juris paras. 47 et seq.). Even if a violation is found to have occurred, ensuring effective judicial protection does not require the court to be empowered to substitute its assessment of the choice of appropriate and necessary remedial powers for that of the authority; Rather, the court must examine whether the supervisory authority has complied with the limits of its discretion (ECJ, judgment of December 7, 2023 – SCHUFA Holding [Residual Debt Discharge], C-26/22 and C-64/22 – ECLI:ECLI:EU:C:2023:958 = juris para. 69). This results in a two-stage review. First, the question must be asked whether the supervisory authority has adequately examined whether a violation of the General Data Protection Regulation has occurred. In the event that
a violation is established, the plaintiff is entitled to a decision regarding supervisory intervention by the state office that is free from errors of discretion (cf. Bavarian Higher Administrative Court, judgment of May 2, 2025 – 5 C 23.2210 – n.v.; Administrative Court
Düsseldorf, judgment of November 11, 2024 – 29 K 4853/22 – juris para. 43; also Federal Fiscal Court, judgment of December 12, 2023 – IX R 33/21 – BFHE
282, 517 = juris para. 32).
15
In dealing with the plaintiff's complaint, the defendant fulfilled its duty under Article 57 (1) (f) GDPR and, in particular, conducted sufficient investigations. The Senate shares the view of the defendant and the Administrative Court that a violation of GDPR provisions cannot be established.
16
According to Article 57 (1) (f) GDPR, the authority must address the complaint, investigate the subject matter of the complaint to an appropriate extent, and inform the complainant of the progress and outcome of the investigation within a reasonable period of time. Article 57 GDPR does not regulate the scope of the investigation that is to be considered "appropriate" within the framework of the principle of official investigation when handling a complaint.
It follows from Recital 141, sentence 2, of the GDPR that the investigation should, subject to judicial review, be as extensive as is appropriate in the individual case. In this respect, the supervisory authority has discretion (Federal Fiscal Court, ibid., juris para. 30 with further references). In doing so, the supervisory authority must handle the complaint with
all due care (see on this requirement ECJ, judgment of 26 September 2024 – C-768/21 –
ECLI:ECLI:EU:C:2024:785 = juris para. 32). The exercise of discretion is subject to judicial review in accordance with Section 114 of the Code of Administrative Court Procedure (VwGO).
17
Accordingly, the defendant dealt with the complaint in a legally compliant manner and was entitled
to refrain from further investigations and taking supervisory measures without any errors of discretion.
In particular, the defendant correctly assumed that there were no sufficient indications of a
data protection violation.
18
aa) The legitimate interest of the controller, which is essential for the lawfulness of the data processing pursuant to
Article 6 (1) subparagraph The fact that the prerequisite for the admission of the action is Article 1(1)(f) GDPR cannot be denied because the operator of the shopping center, who is responsible for data processing, does not have the right to control the property at the disputed location.
19
It is undisputed among the parties that the bench on which the plaintiff was filmed sitting is located within the scope of the usage agreement dated May 7, 1997, as shown in the site plans. According to the plaintiff's statements in the grounds for admission, the bench is located at the front of the shopping center and is made of tubular steel. However, without any justification, the plaintiff claims that the bench is located on a publicly designated path within the meaning of Section 9 of the usage agreement. The grounds for admission do not indicate whether the plaintiff is aware of the location of these paths,
as is also evident from the plan submitted by the defendant during the oral hearing before the Administrative Court and made available to him by the city. According to the record,
there is nothing to suggest that the bench is located on a public path.
20
Whether the usage agreement also extends the exercise of the right of occupancy to the publicly designated paths can, in view of the above, be left open in the context of the admission procedure. However, along with the defendant and the Administrative Court, it can be assumed that the usage agreement is to be interpreted in such a way that the operator of the shopping center was granted right of occupancy, at least in the areas not designated for public use. The right of occupancy is based on the ownership or (as in this case) possession of the property (§§ 858 et seq., 903, 1004 BGB) and generally allows its owner to freely decide who to grant access to and who to deny access to (Federal Court of Justice, judgment of May 29, 2020 – V ZR 275/18 – NJW
2020, 3382 = juris para. 5). To interpret the provision of the usage agreement under No. 1, which states that the facility must always be kept open to the public, as meaning that a right of occupancy under private law does not exist, would so significantly restrict the contractual right of use that it cannot be assumed that this corresponded to the intention of the contracting parties. As a correlate to the use granted for commercial purposes, there is also the right to exclude certain behaviors, which are also considered necessary for reasons of infection control law, through house rules and to have them enforced, for example, by issuing a ban on entry. The municipal general order cited by the plaintiff pursuant to Section 24 Para. 1 No. 1 of the 11th BayIfSMV of January 11, 2021, cannot, as the Administrative Court rightly stated, be considered to have any meaningful meaning regarding the scope of the right of access. Furthermore, the bundle of obligations in the use agreement also suggests that the contractually intended transfer of the right of access is to be assumed. Possession of the right of access is likely also necessary for the fulfillment of the obligations. The Administrative Court has already referred to the obligation to maintain and care for these areas pursuant to No.
3. In addition, there are traffic safety obligations (No. 6) and the assumption of liability for all damages
and accidents directly related to their use (No. 7). The decision of the Düsseldorf Administrative Court of December 7, 2011 (18 K 3554/11 – juris)
cited by the plaintiff is based on a different set of facts, because that decision concerned the exercise of the fundamental right of
freedom of expression in a manner that is acceptable to the public on private property made available to the public without restriction, but in this case, it concerned an area whose use was already restricted by the house rules for reasons of infection control law. The agreement on an amicable settlement reached between the plaintiff's then-lawyer and the operator of the shopping center also does not indicate that the managing director of the operator assumes that he is not exercising his right of access to the area in question. To the extent that his email of January 21, 2022 states that the security service will receive a separate notice, he is clearly referring to the lifting of the ban on entry.
21
bb) The Administrative Court also rightly assumes that the question of whether the plaintiff behaved aggressively cannot be proven and that the defendant cannot be held responsible for any investigative deficit in this regard.
22
The State Office, as a supervisory authority within the meaning of Articles 51 et seq. of the GDPR, is responsible for determining violations, but if they cannot be proven, it does not bear the "burden of proof" in the sense that it would then have to determine a violation "in case of doubt." Rather, it can be inferred from the regulatory framework of the GDPR that the power to remedy the situation only exists in the case of established violations (cf. Article 58 (1) and (2) GDPR). A violation of data protection law is not established because it is clear beyond doubt that the plaintiff did not behave aggressively. Nor is it ruled out a priori that a person sitting and eating can be aggressive. As the defendant and the Administrative Court correctly point out, the statements of the plaintiff and the managing director of the security service are contradictory. It is not true that the Administrative Court assumed that the plaintiff behaved aggressively. Rather, the judgment acknowledges that the defendant rightly assumed that this could not be proven. Furthermore, it cannot be concluded from the police memorandum of January 20, 2021, for the reasons stated by the Administrative Court, to which reference is made (p. 12 of the judgment), that the plaintiff was not aggressive. Furthermore, the judgment correctly pointed out that the defendant is not subject to an unlimited duty to investigate, but rather that dealing with the matter to an appropriate extent is a matter of individual case and balancing, and this has been satisfied here. In particular, the plaintiff cannot point to the fact that the film recordings could have been viewed regarding his conduct. According to the statement of the person responsible dated April 7, 2021, the recordings had already been deleted by the defendant at the time this letter was received. Nor did the defendant initiate a further investigation by questioning persons who had viewed the film recordings. Firstly, it was not obvious to the defendant that the recordings had been viewed at all. Secondly, it can be assumed that they were irrelevant. In his statement of defense dated April 20, 2021, the defendant refers to the fact that the recordings had been viewed at all.
September 2021, it is understandable that the use of the camera may lead to a
change in behavior and thus no longer capture any prior aggressive behavior – which would have fundamentally justified filming. The (questionable) probative value of such
a possible memory is therefore irrelevant.
23
cc) The plaintiff's objections, which he also raised, that the manner in which the filming was carried out
violated several provisions of the GDPR, are also unsuccessful. The defendant
rightly points out in this respect that it could not be determined to what extent the controller complied with its information obligations pursuant to Art. 12 et seq. GDPR
in the specific incident, without the defendant being accused of a lack of investigation. In particular,
the inability to prove this also applies insofar as it is disputed between the persons involved whether or not there was prior notice of the use of the body camera; Reference is made to the relevant statements (copy of the judgment, pp. 14/15), which the plaintiff does not address. The plaintiff has also not substantiated the extent to which he filed a request for deletion and information that was not processed.
24
2. The alleged procedural defect pursuant to Section 124 (2) No. 5 of the Code of Administrative Court Procedure (VwGO) is also not present. In this respect, the plaintiff submits that the user agreement relevant to the decision was only presented at the oral hearing and only to the court. Its provisions could not have been read in detail and used orally in a hurry. A response was not possible because the judgment had already been pronounced on the same day. The agreement was only received by him together with the judgment and the minutes.
25
The plaintiff has therefore not demonstrated a violation of his right to a fair hearing, pursuant to Article 103 (1) of the Basic Law. The central component of judicial decision-making is the oral hearing, see Section 101 (1) Sentence 1 and Section 108 (1) Sentence 1 of the Code of Administrative Court Procedure (VwGO). The judgment may only be based on facts and evidence on which the parties have had the opportunity to comment (Section 108 (2) VwGO). The court did not violate this by following the procedure described. The submission of documents relevant to the decision only at the oral hearing does not, in itself, constitute a procedural error. The contract was discussed with the parties at the oral hearing, and the plaintiff, according to the minutes, made use of the opportunity to comment. To the extent that the plaintiff now claims that this was not sufficient, it should have been incumbent upon him to immediately request a copy of the agreement and to request a postponement of the hearing or an extension of time to file a written submission (cf. Section 173, Sentence 1, Administrative Court Code (VwGO) in conjunction with Section 283, Code of Civil Procedure (ZPO). A person who could have made his case heard but failed to do so cannot invoke a denial of a fair hearing (cf. Federal Administrative Court, judgment of November 29, 2012 – 4 C 8.11 – BVerwGE 145, 145-153 = juris para. 12; judgment of August 4, 2008 – 1 B 3.08 – Buchholz 310
Section 138, No. 3, Administrative Court Code (VwGO) No. 70 = juris para. 9). Since the plaintiff has failed to comply with his obligation in this regard,
he cannot successfully assert a violation of the right to be heard.
26
Should the plaintiff also assert, by means of a procedural complaint, that the defendant failed to forward the statement of the shopping center operator to him, this would not constitute a
defect in the judicial proceedings; the plaintiff has not presented any evidence in this regard. Furthermore, the plaintiff could have commented on this during the judicial proceedings (and did so). Furthermore, he would have been free to request inspection of the files from the defendant at an earlier point in time and to inform himself about the status of the investigation.
27
3. The decision on costs follows from Section 154 (2) of the Code of Administrative Court Procedure (VwGO).
28
The determination of the value in dispute is based on Sections 47 and 52 (2) of the Act on the Court of Appeal. The default value in dispute is correctly assumed to be EUR 5,000, because the facts and circumstances of a claim for intervention under data protection law generally do not provide sufficient guidance, including for determining the value in dispute. In particular, the asserted claim is not quantifiable.
To the extent that the plaintiff cited an amount of EUR 500 in the letter dated August 18, 2021, this is a far-fetched assertion: The letter does not contain any comprehensible information as to why an amount of EUR 500 should correspond to the importance of the matter for him as stated in the plaintiff's application.
29
With regard to the first-instance proceedings, the Senate exercises its power to amend the decision pursuant to Section 63 (3) Sentence 1 No. 2 of the German Court Act (GKG).

``` 30
This decision, which renders the first-instance judgment final (Section 124a (5) Sentence 4 of the Administrative Court Code (VwGO)), is
final and binding (Section 152 (1) of the Administrative Court Code).