What AI changes compared with ordinary CCTV
A camera that only records, and is checked after an incident, processes little. A system that analyses every image, detects people and vehicles and sends alerts processes far more, and does so all the time. Data protection law and works councils look at this difference closely.
Adding AI analysis to existing cameras can therefore count as a new purpose. An existing assessment, sign or works agreement written for recording only usually needs updating before the analysis goes live.
This page is general information, not legal advice. The assessment for your site stays with your data protection officer and, where needed, your lawyer.
GDPR: the legal basis and the purpose
For companies, video surveillance usually rests on legitimate interests (Art. 6(1)(f) GDPR): protecting property, preventing accidents, clarifying incidents. That requires a balancing test: your interest against the interests of the people on camera. The balance tips in your favour when the purpose is clear, the surveillance is limited to what that purpose needs, and less intrusive means would not work as well.
- Set the purpose per camera. “Security” is too vague. “Detect intrusion into the yard between 8 pm and 6 am” is a purpose you can defend.
- Limit the image. Mask public pavements, neighbouring plots and areas that are not part of the purpose.
- Never in private spaces. Toilets, changing rooms, break rooms and sleeping areas are off limits.
- Avoid special categories. Facial recognition processes biometric data (Art. 9 GDPR), which is allowed only in narrow cases. Systems that detect events without identifying people avoid this.
For employees, a works agreement can set out the rules for processing their data (Art. 88 GDPR). It does not replace the balancing test, but it makes purposes and limits binding.
Retention, access and processors
- Short retention. European and German supervisory authorities expect recordings to be deleted within a few days, as a rule of thumb within 72 hours, unless an incident justifies keeping them longer. Incident clips can be kept as long as the incident needs.
- Access by role. Decide who may see live images, who may search and who may export clips, and log every access.
- Processor agreement. A provider that processes video on your behalf needs a data processing agreement under Art. 28 GDPR, with technical and organisational measures attached.
- Data location. Processing in the EU, in your own cloud or on your premises avoids the extra steps of transfers outside the EU.
Signs and information
People must know they are being filmed before they enter the area. In practice that means a sign at eye level before the camera's field of view, with the essentials, and a second layer with the full information under Art. 13 GDPR, for example on your website or at reception. If the cameras use AI analysis, say so.
See our signage checklist for what belongs on the sign.
When a data protection impact assessment is needed
A data protection impact assessment (DPIA, Art. 35 GDPR) is required when processing is likely to result in a high risk. The GDPR names systematic monitoring of publicly accessible areas on a large scale, and the German supervisory authorities list further cases. With AI analysis on top of cameras, plan a DPIA in any case: it is the document your data protection officer and works council will ask for, and it makes you take the decisions that make the system defensible.
Our checklist for the DPIA and the works agreement lists what to cover.
The works council: co-determination under § 87 BetrVG
In Germany, the works council has a right of co-determination over technical systems that are suitable for monitoring employees' behaviour or performance (§ 87(1) no. 6 BetrVG). The courts read “suitable” broadly: it is enough that the system could be used that way, whatever the employer intends. Cameras on the site almost always qualify, with or without AI.
- Involve the works council early. The employer must inform it about planned technical systems, including AI, in good time (§ 90 BetrVG).
- Expert advice. When AI is introduced, the works council may call in an external expert, and the law regards this as necessary (§ 80(3) BetrVG).
- Written agreement. Co-determination is exercised through a works agreement. Without agreement, a conciliation board decides; going live without it is not an option.
- Existing agreements. An agreement for recording-only CCTV usually does not cover AI analysis. Update it before the analysis starts.
Your works council will want to know whether the system can be used to monitor employees. The answer has to be in the configuration as well as in the agreement: events instead of people, no identification, no tracking, no figures per employee, short retention.
The EU AI Act: what is prohibited, what is high-risk, and when
The EU AI Act regulates AI systems by risk. For video analytics, these are the points that matter:
| Function | Status under the AI Act | Since or from |
|---|---|---|
| Emotion recognition at the workplace | Prohibited | February 2025 |
| Biometric categorisation by sensitive traits; untargeted scraping of facial images | Prohibited | February 2025 |
| Remote biometric identification (e.g. facial recognition of people on camera) | High-risk, strict obligations | 2 December 2027 |
| AI to monitor and evaluate employees' performance and behaviour | High-risk, strict obligations | 2 December 2027 |
| Detecting events, objects and vehicles without identifying people | Not high-risk as such; the GDPR applies | – |
| Every AI system: staff using it need sufficient AI literacy (Art. 4) | Obligation for deployers | February 2025 |
The high-risk dates were moved by the Digital Omnibus: the obligations for stand-alone high-risk systems, for example in biometrics and employment, now apply from 2 December 2027. A system that detects fire, intrusion or missing safety gear and reports events, without identifying people or evaluating employees, stays outside the prohibited and high-risk groups, provided it is really used that way. That is why the purpose and the works agreement matter as much as the technology.
How ProDataAI Lens is set up for these rules
- No facial recognition, no biometric identification, no emotion recognition, no employee performance monitoring.
- ProDataAI Lens reports events and does not track individuals across cameras or keep figures per employee. Search can be switched off.
- Only incident data is stored (the event with a snapshot and a short clip), for a retention period you set. Full recordings stay on your own recorder.
- Access by role, every access logged.
- Runs in an EU cloud environment, in your own cloud or on your premises.
- A data protection and security pack: data processing agreement (on your template or ours), a template DPIA, our technical and organisational measures and a template for your works council agreement.
Frequently asked questions
Is AI video surveillance allowed in Germany?
Yes, with a clear purpose, a balancing test in your favour, limited image areas, short retention, transparent signage and, where employees can be seen and there is a works council, a works agreement. Facial recognition and employee monitoring are where the line is.
Do we need a new works agreement if we already have one for our cameras?
Usually yes, or an amendment. An agreement written for recording does not cover systematic AI analysis, which is a new purpose and a new kind of processing.
Is a DPIA mandatory for AI video analytics?
Often, and it is advisable in any case. The GDPR requires one for systematic large-scale monitoring of publicly accessible areas, and German supervisory authorities list further cases.
Is ProDataAI Lens a high-risk AI system under the EU AI Act?
ProDataAI Lens detects events, objects and situations and does not identify people, recognise emotions or evaluate employees, so it is designed to stay outside the prohibited and high-risk groups. How you use it matters too, which is why purposes are documented.
How long may we keep recordings?
As a rule of thumb, a few days, often 72 hours, unless an incident requires longer. Incident clips can be kept as long as the incident needs.