Video surveillance in rental properties: What should landlords be aware of?

Video surveillance of rented properties is only possible under strict legal conditions. More and more owners want to keep an eye on and secure their properties in this way. However, tenants are not always in agreement. While some feel better protected by cameras, others see surveillance as an invasion of their privacy or a professional or trade secret. For landlords, the question therefore arises as to the conditions under which the use of video surveillance is legally permissible and how the different interests can be reconciled in the best possible way. Both data protection regulations and tenancy law requirements must be taken into account. The question of costs is also interesting: can the costs of video surveillance be passed on to the tenants and, if so, to what extent?

Data protection framework for video surveillance in rental properties

The legal requirements for the use of video surveillance in rented buildings are essentially derived from the General Data Protection Regulation (GDPR). In practice, the legal basis is regularly Art. 6 para. 1 lit. f GDPR. Consent is typically unsuitable due to the lack of voluntariness in the tenancy. The legitimate interests of the property owner – such as the protection of property, the prevention of criminal offenses or the preservation of evidence – must be reconciled with the rights and freedoms of the data subjects. In accordance with Art. 6 para. 1 lit. f GDPR, the processing of personal data is only permitted if it is necessary to safeguard legitimate interests and does not conflict with any overriding interests or fundamental rights of the data subjects.

Video surveillance requirements in detail

In practice, this means that video surveillance is not just permissible if there is a general need for more security. Concrete, objectifiable evidence of an increased risk situation is regularly required, such as past break-ins, attempted break-ins, vandalism or an increased crime rate at the location. Such incidents or a corresponding risk situation should be documented in a structured manner so that the legitimate interest in a surveillance measure can be clearly demonstrated.

In addition, video surveillance must be suitable, necessary and appropriate to actually achieve the desired objective – for example, protection against theft or damage to property. Before installation, it should be checked whether milder, equally suitable alternatives such as better lighting, access controls or the use of security personnel would be sufficient. This assessment must be documented. If these alternatives are impractical or inadequate, video surveillance may be considered proportionate.

The interests of all stakeholders must be taken into account

A further requirement is the legally prescribed balancing of the interests of the data subjects and the legitimate interests of the controller. In particular, the number of data subjects, the spatial scope of the video surveillance and the type of location being monitored must be taken into account. It must also be assessed whether the persons concerned pass through the areas necessarily and regularly, such as the building entrance or the elevator, and what level of privacy is expected there. This is usually higher in residential properties. The interests of employees, customers and service staff can also be affected by surveillance and must be taken into account when weighing up the situation. As a general rule, restricting surveillance to generally accessible areas does not mean that the interests of the property owner “generally” prevail. It is always necessary to weigh up the interests on a case-by-case basis, taking into account the duration and intensity of the surveillance, among other things.

Particular caution is required when renting accommodation

Particular caution is required in the case of residential tenants: The threshold for the permissibility of video surveillance is significantly higher here than for properties used exclusively for commercial purposes. Privacy enjoys a particularly high level of protection in residential properties. Under no circumstances may surveillance be used to monitor living or usage behavior and must always be limited to what is absolutely necessary. Cameras may not record apartment doors, windows, balconies, letterboxes or clearly identifiable parking spaces. The angle of view must be strictly limited and privacy zones and masking must be used. Neighboring properties and public streets must be hidden. Sound recordings are generally not permitted. Permanent observation or live monitoring is generally disproportionate.

Violations of the requirements of the GDPR can not only lead to measures being taken by the supervisory authorities, but can also result in injunctive relief, claims for removal and claims for damages. The data protection review should therefore be carefully documented for each individual camera.

What else needs to be considered from a data protection perspective

Data protection impact assessment (DPIA)

As soon as video surveillance is likely to entail an increased risk to the rights and freedoms of data subjects – especially in the case of systematic and extensive surveillance of publicly accessible areas – a DPIA must be carried out before processing begins. The DPIA includes at least a description of the processing, an assessment of necessity and proportionality, a systematic risk assessment and the planned remedial measures. It should be accompanied not only legally, but also technically. An IT security concept that regulates access restrictions/roles and the separation of tasks, for example, is a key component here.

List of processing activities

Every camera processes personal data and must therefore comply with the GDPR. Art. 30 para. 1 GDPR must appear in the record of processing activities. Landlords should not only document the purpose and legal basis here, but also the categories of data subjects, the storage period and any recipients of the data.

Duty to inform

According to Art. 13 GDPR, the landlord must draw attention to video surveillance. A sign with a camera symbol alone is not sufficient. A sign at the entrance with the core data and additional detailed data protection information as a notice nearby, which can also be accessed digitally, are recommended. People should be informed clearly and comprehensibly about the purpose, legal basis, storage period and the rights of the data subjects before entering. This also includes the contact details of the controller and, if applicable, the data protection officer.

Storage duration and deletion concepts

The recordings of the camera may not be used acc. Art. 5 par. 1 lit. e GDPR may not be stored for longer than is necessary for the specified purpose. Data protection authorities and case law recommend a maximum storage period of 48 hours, and in some cases up to 72 hours. The decisive factor is whether the duration is proportionate to the purpose. In the case of repeated incidents or ongoing investigations, longer storage may be permissible – provided it is documented and justified. However, blanket, precautionary data retention is not permitted. The selected period must be reviewed regularly and adjusted if the risk situation changes.

Implementation in practice: transparency and technical specifications

All persons likely to be affected, in particular tenants, service providers and any employees, must be fully informed before video surveillance is put into operation. Ideally, the introduction of video surveillance should be organized in dialogue with the tenants in order to create acceptance and address possible objections at an early stage.

During technical implementation, care must be taken to ensure that cameras are only aimed at the areas that actually need to be protected. To ensure this, care should be taken to align the cameras precisely; if necessary, technical aids such as pixelation can be used.

Access to the recordings must be restricted to a very limited group of people and must be documented in a comprehensible manner. The data protection review, including the balancing of interests, and all measures taken should also be carefully recorded so that information can be provided at any time in the event of queries from supervisory authorities or data subjects.

Cost allocation to tenants

A differentiated approach must be taken when allocating the costs of subsequently installed video surveillance. The one-off costs for purchase and installation cannot usually be passed on to the tenants, as there is neither a legal nor a contractual basis for this. The situation is different for the ongoing costs of a video surveillance system: these can be passed on to the tenants as ancillary costs if the tenancy agreement contains a corresponding provision. Tenancy agreements often contain clauses that provide for the allocation of surveillance or security costs. According to recent case law, this can also include the running costs of a video surveillance system. In this context, the Berlin Court of Appeal ruled that such costs are in any case apportionable if the tenancy agreement provides for the assumption of the “costs of guarding the building”. This wording is broad enough to also cover the running costs of a video surveillance system. If, on the other hand, there is no explicit and sufficiently specific provision, the costs of video surveillance cannot generally be passed on to the tenant. The catalog of operating costs pursuant to Section 2 of the current Operating Costs Ordinance does not include the running costs associated with video surveillance.

In order to create legal certainty, the apportionment of the running costs of a video surveillance system should be explicitly and clearly regulated in the tenancy agreement, for example by adapting the model tenancy agreements or addenda to existing agreements. As is generally known, other operating costs are only apportionable if they are specified individually in the tenancy agreement.

Conclusion

Video surveillance of rental properties is only permitted under strict conditions. When landlords install surveillance cameras in or on their buildings, they must comply with a number of legal requirements. They should make the measure transparent from the outset and involve tenants at an early stage. Data protection-compliant design, comprehensive documentation and a clear contractual provision on the allocation of ongoing operating costs – if necessary by means of an addendum to the rental agreement – are essential. In summary, careful planning and open communication minimize legal risks and protect the legitimate interests of all parties involved.