Workplace Surveillance in Germany: Video Monitoring, the Works Council and What § 26 BDSG Still Does

German law has no statute called workplace surveillance law. What an employer may observe, film, log or measure is worked out from three separate bodies of rules that arrive at the same camera from different directions, and they can each defeat a monitoring measure on their own.

The first is data protection law, where the question is whether there is a legal basis and whether the measure is necessary. The second is collective labour law, where a works council has a co-determination right over technical devices capable of monitoring behaviour or performance, and where no agreement is reached the Einigungsstelle decides under § 87 Abs. 2 BetrVG. The third is criminal law, which draws hard lines that no balancing exercise can cross.

Employees usually search for the camera question, and cameras are the sharpest version of the problem. The same analysis governs screen monitoring software, GPS in company vehicles, access-card logging, keystroke counting and call recording, because none of those has its own permission either.

This page explains which legal basis actually applies after the EuGH ruling of 2023, what § 26 BDSG still does, why continuous filming of a workstation is treated as impermissible in principle, what changes when there is a concrete suspicion of a criminal offence, why § 87 Abs. 1 Nr. 6 BetrVG is frequently the practical obstacle, and which authority supervises any of it.

Information last verified on 20 July 2026. This page provides general legal information and does not constitute legal advice in an individual case.

Which law applies after the EuGH ruling of 2023

For years the standard answer was § 26 BDSG, the provision on processing employee data for the purposes of the employment relationship. That answer became unreliable on 30 March 2023.

In case C-34/21 the EuGH ruled on the German implementation of Art. 88 DSGVO. Art. 88 Abs. 1 DSGVO is an opening clause that lets member states adopt more specific rules for employment, and Art. 88 Abs. 2 DSGVO says such rules must include suitable and specific measures to safeguard human dignity, legitimate interests and fundamental rights, with particular regard to transparency, transfers within a group of undertakings, and monitoring systems at the workplace.

The court held that a national provision which does not satisfy Art. 88 Abs. 2 DSGVO cannot be based on the opening clause in Art. 88 Abs. 1 DSGVO, and that a rule which merely repeats what the DSGVO already requires for all processing is not a more specific rule at all. The case concerned § 23 Abs. 1 Satz 1 HDSIG, the Hessian equivalent, but § 26 Abs. 1 Satz 1 BDSG is drafted the same way.

The Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg sets out the consequence plainly in its published FAQ on the judgment: § 26 Abs. 1 Satz 1 BDSG cannot legitimise any processing that is not already permissible under Art. 6 Abs. 1 DSGVO. Processing that used to be justified by the general clause is now assessed directly against the DSGVO, typically under Art. 6 Abs. 1 lit. b DSGVO for what the employment contract itself requires, and under Art. 6 Abs. 1 lit. f DSGVO for the employer's other interests, which is where surveillance sits.

It is worth being precise about the practical effect, because it is smaller than the headlines suggested. The substance of the test barely moved: necessity and a balancing of interests were already the operative questions. What changed is that the general clause can no longer carry the argument by itself, and that the legal basis stated in privacy notices and records of processing has to reflect that.

What § 26 BDSG still does

The provision was not repealed and it has not gone quiet. Only § 26 Abs. 1 Satz 1 BDSG is the general clause the EuGH judgment undermines. The rest of the section continues to matter a great deal to workplace monitoring.

§ 26 Abs. 1 Satz 2 BDSG contains the separate and stricter rule for processing employee data in order to detect criminal offences. § 26 Abs. 2 BDSG governs when consent in an employment relationship can be voluntary. § 26 Abs. 4 BDSG allows processing on the basis of collective agreements, subject to Art. 88 Abs. 2 DSGVO. § 26 Abs. 6 BDSG expressly leaves the participation rights of employee representative bodies untouched, and § 26 Abs. 8 BDSG defines who counts as an employee, a definition that reaches temporary agency workers, trainees, applicants and former employees.

So the correct description of the current position is that § 26 BDSG is operative but constrained: it is the framework German practice still works within, while the general permission at its head can no longer do the heavy lifting on its own.

Continuous filming of a workstation

The Datenschutzkonferenz, the joint body of the federal and Land data protection authorities, published a detailed Orientierungshilfe on video surveillance by non-public bodies in 2020. Its section on employee monitoring is the clearest published statement of how German regulators approach the question.

Permanent video surveillance in an employment relationship is described there as a serious interference with employees' personality rights and as regularly impermissible. The reasoning is behavioural rather than technical: if employees must fear throughout their working time that their conduct is being recorded, later reconstructed and reviewed, that creates continuous monitoring and conformity pressure, and unusual or merely different behaviour exposes them to the risk of later criticism, ridicule or sanction.

Two further statements in that guidance are worth quoting in substance. Cameras are not permitted where the purpose is to check employees' work performance, care or efficiency, so surveillance for behaviour or performance control is impermissible. And permanent workstations, or areas where employees spend longer periods, may in principle not be filmed at all, including where the stated purpose is preventing theft.

A distinction runs through the whole section. Employees who are incidentally captured by a camera protecting goods in a publicly accessible sales area are in a different position from employees who are the focus of a camera. In the first situation the assessment runs through Art. 6 Abs. 1 lit. f DSGVO, and the authorities accept that theft on a retail sales floor is a business-typical risk, provided the coverage is limited to the areas genuinely at risk and employees retain uncovered areas. Once employees are in the focus of the camera or are permanently captured, that reasoning stops applying.

Covert monitoring and the suspicion threshold

Secret surveillance is not a category German law simply forbids, but the gateway is narrow and it is a different gateway from the one used for ordinary open cameras.

§ 26 Abs. 1 Satz 2 BDSG permits processing employee data to detect a criminal offence only where documented factual indications ground a suspicion that the person concerned has committed a criminal offence in the employment relationship, where the processing is necessary for detection, and where the employee's legitimate interest in excluding it does not outweigh, in particular where the nature and extent of the measure are not disproportionate to the occasion.

Each element does work. The suspicion must relate to a criminal offence rather than a breach of contract, it must rest on facts that were documented before the measure started rather than assembled afterwards, and it must be directed at a person or a narrowly definable group. The authorities state that a permanent surveillance installation cannot be based on this provision at all, since it allows only a temporary measure, and that an employer may not collect employee data preventively in the hope that a suspicion will later crystallise.

Why the works council is often the real obstacle

§ 87 Abs. 1 Nr. 6 BetrVG gives the works council a co-determination right over the introduction and use of technical devices which are intended to monitor the behaviour or performance of employees. German practice reads that provision broadly, because a system does not have to be designed for monitoring to be objectively suitable for it.

Co-determination here is not consultation. Under § 87 Abs. 2 BetrVG, if no agreement is reached the Einigungsstelle decides, and its award replaces the agreement between employer and works council. A measure introduced without going through that process is exposed on collective law grounds regardless of how the data protection assessment comes out.

This is why, in a business with a works council, the operative document is usually a Betriebsvereinbarung. The Datenschutzkonferenz guidance lists what such an agreement should settle: the subject matter of the processing, purpose limitation, data minimisation, the nature and extent of the data, the recipients, the rights of those affected, deletion periods and the access and authorisation concept. It also says an agreement should make clear that performance control is expressly excluded as a purpose, and it notes that where no works council exists the employer should still regulate camera installations internally, for example through data protection compliant work instructions.

Note the interaction with the EuGH ruling. A collective agreement under § 26 Abs. 4 BDSG has to observe Art. 88 Abs. 2 DSGVO, which means it cannot simply authorise monitoring; it has to contain the safeguarding measures that provision requires.

Places a camera may not go

Some areas are excluded rather than balanced. The authorities treat observation touching the intimate sphere as regularly disproportionate and therefore impermissible, naming toilets, saunas, showers and changing areas, and in the employment section they add sanitary facilities, break rooms, staff rooms and rest areas.

Criminal law backs part of that line. Under § 201a Abs. 1 Nr. 1 StGB it is an offence punishable by up to two years imprisonment or a fine to make or transmit, without authorisation, an image of a person who is in a dwelling or in a room specially protected against view, where this violates that person's höchstpersönlicher Lebensbereich. A camera in a changing cubicle or a toilet is not a data protection problem to be weighed. It is a criminal one.

Retention, worked through

Storage duration is where an otherwise defensible installation most often drifts out of shape, and it is one of the few places where German guidance gives a usable number.

The Datenschutzkonferenz position is that whether footage needs to be secured can normally be clarified within one to two working days, so a retention period of 72 hours is as a rule permissible. Longer retention is not banned, but the justification burden rises with the period, and it attaches to specific cameras and specific circumstances rather than to the whole system.

Take a warehouse operator who monitors a goods entrance outside business hours and keeps everything for 30 days because that is the recorder's factory setting. Across a month that installation retains roughly 30 days of footage of every driver, contractor and employee who passed the entrance, in order to preserve the small number of sequences that might matter. On a 72 hour cycle the same installation still captures every incident, because damage, shortfalls or intrusion are normally noticed within a day or two and the relevant sequence can then be secured before it is overwritten. The evidential value is close to identical and the volume of retained data on uninvolved people falls by roughly nine tenths. The guidance does contemplate extending the period for a specific reason, for instance over a multi-day closure when nobody is on site to notice damage, but it says internal workflow convenience is not such a reason.

Sound, screens and other monitoring

Audio is the strictest part of the picture and the part most often overlooked, because many camera models ship with a microphone enabled. § 201 StGB makes it a criminal offence, punishable by up to three years imprisonment or a fine, to record without authorisation the non-publicly spoken word of another person. The Datenschutzkonferenz guidance responds to this directly: where a video surveillance camera has an audio function, that function is to be irreversibly deactivated.

§ 201 StGB is also an absolute Antragsdelikt. § 205 Abs. 1 Satz 1 StGB makes prosecution under § 201 Abs. 1 and Abs. 2 StGB dependent on an application by the victim, and the override for a special public interest in § 205 Abs. 1 Satz 2 StGB applies only to §§ 201a, 202a, 202b and 202d StGB, not to § 201 StGB. So an unauthorised workplace recording of speech is prosecuted only if the person recorded applies for it. The rules on recording speech are set out at recording conversations.

Non-camera monitoring runs through the same structure. Software that logs activity on a work computer, telematics in a company vehicle, access-card records analysed for attendance patterns and call recording all process employee data, all need a basis under Art. 6 Abs. 1 DSGVO, all are subject to the same necessity and balancing test, and all are technical devices objectively suitable for monitoring behaviour or performance, which brings § 87 Abs. 1 Nr. 6 BetrVG into play.

When monitoring was unlawful

A common assumption is that data protection breaches make the resulting material unusable in an employment tribunal. German law does not work that way, and the Bundesarbeitsgericht said so clearly on 29 June 2023 in case 2 AZR 296/22.

An employee was dismissed after his employer, acting on an anonymous tip, reviewed footage from a clearly signposted camera at a works gate, which according to the employer showed him leaving the site before an overtime shift he then claimed payment for. The lower courts held the footage subject to an exclusion. The Bundesarbeitsgericht reversed and referred the case back, holding that in unfair dismissal proceedings there is in principle no prohibition on using recordings from open video surveillance intended to prove intentionally contract-breaching conduct, and that this applies even if the employer's surveillance measure did not fully comply with data protection requirements. It also held it irrelevant in principle how long the employer waited before first viewing the material. The court expressly left open whether an exclusion might apply where an open surveillance measure amounts to a serious violation of fundamental rights.

Two things follow. Admissibility in the labour court and lawfulness under data protection law are separate questions, exactly as they are for dashcams, and the finding turned on the surveillance being open. That reasoning does not transfer to covert monitoring. The parallel question in German civil and criminal proceedings is dealt with at secret recordings as evidence.

Who supervises workplace surveillance

Enforcement in Germany is split by the type of entity supervised, not shared. The Bundesbeauftragte für den Datenschutz und die Informationsfreiheit, the BfDI, supervises federal public bodies together with telecommunications and postal providers. The seventeen Landesdatenschutzbehörden supervise the public bodies of their own Land and its municipalities, and in addition virtually the entire private economy. Bavaria is the exception worth knowing: it runs two, the Bayerischer Landesbeauftragte für den Datenschutz for public bodies and the Bayerisches Landesamt für Datenschutzaufsicht for the private sector, which is why there are seventeen Land authorities for sixteen Länder.

For an employee of a private company, that means the competent authority is the data protection authority of the Land in which the employer is established, and a complaint about a camera at work belongs there rather than with the federal authority. Complaints are free and can be made without a lawyer. A works council, where one exists, is a parallel route with its own leverage under § 87 Abs. 1 Nr. 6 BetrVG, and the civil courts are a third, since the authorities themselves point out that civil claims for an injunction or damages can be brought against a controller through the civil courts.

Related pages cover a camera pointed at your home by a neighbour, cameras in vehicles at dashcams, the German recording law overview, and the wider guide at Germany.

Frequently Asked Questions

Is video surveillance at the workplace allowed in Germany?

It is not banned as such, but the room is narrow. The German data protection authorities treat permanent filming of workstations as regularly impermissible, and cameras whose purpose is to check employees' performance or conduct as impermissible. Surveillance limited to a genuine security purpose in a defined area, where employees are only incidentally captured and retain uncovered areas, is the situation that can be justified.

Does my employer have to tell me about a camera?

As a rule yes. The DSGVO transparency duties in Art. 13 and Art. 14 DSGVO apply, and open surveillance is what the case law and the authorities assume. Covert measures are the exception and are confined to the narrow route in § 26 Abs. 1 Satz 2 BDSG.

Is § 26 BDSG still valid after the EuGH judgment?

The provision is still in the statute book unchanged. What the EuGH decided on 30 March 2023 in C-34/21 is that a general clause of that type is not a more specific rule under Art. 88 Abs. 1 DSGVO, so § 26 Abs. 1 Satz 1 BDSG cannot on its own legitimise processing that Art. 6 Abs. 1 DSGVO does not already permit. The other paragraphs of § 26 BDSG, including the offence detection rule and the consent rule, continue to apply.

Is a new German employee data protection act coming?

Not at present. A draft Beschäftigtendatengesetz was prepared in the previous legislative period and did not become law, and the project does not appear in the current coalition agreement. The position described on this page is the operative one and there is no enacted replacement waiting to commence.

Can my employer film me secretly if theft is suspected?

Only within § 26 Abs. 1 Satz 2 BDSG, which requires documented factual indications grounding a suspicion of a criminal offence against a person or a narrowly definable group, necessity, and proportionality to the occasion. A general suspicion of the workforce does not meet it, and the authorities state that a permanent installation cannot be based on this provision.

Can the works council block a camera system?

§ 87 Abs. 1 Nr. 6 BetrVG gives the works council co-determination over the introduction and use of technical devices suitable for monitoring behaviour or performance. If no agreement is reached, the Einigungsstelle decides under § 87 Abs. 2 BetrVG and its award replaces the agreement. Where a works council exists this is often the decisive practical hurdle.

How long may workplace camera footage be kept?

The Datenschutzkonferenz position is that whether footage needs to be secured can normally be clarified within one to two working days, so 72 hours is as a rule permissible. Longer retention needs a specific justification tied to specific cameras and circumstances, and internal workflow convenience is not accepted as one.

Where do I complain about surveillance at work?

For a private employer, the competent supervisory authority is the Landesdatenschutzbehörde of the Land where the employer is established. The BfDI supervises federal public bodies plus telecommunications and postal providers, so it is not the right address for a private workplace.