Video surveillance of dedicated laboratory rejected by single employee [Germany] We have a dedicated laboratory with very expensive and sensitive equipment. When handled incorrectly, they can cause serious harm to the user or others in the laboratory. Our department consists of 5 people who have access to this laboratory. Therefore we introduced a couple of safety regulations (only supervised people are allowed to enter, entry-list with date/time, etc). As next step we wanted to install an surveillance camera. The camera is configured that it takes a photo if it detects movement and stores this photo 7 days. We also ordered the corresponding warning stickers that this area is under surveillance. There are no fixed workplaces inside the laboratory. Its plainly for manufacturing, testing and experiments. Everyone in our department has an separate workplace in an non-surveilled area. We (our department, 5 persons) had a vote if we think this surveillance is ok. Only one guy voted against. He does not want to be surveilled when he works in this laboratory. Its the same guy that always leaves the laboratory like a mess. As we voted 4:1, we are now employing the surveillance measures. However, this guy causes a commotion, throws ramblings about DSGVO and that it is illegal. Is this really illegal in Germany? It's a dedicated room, a critical area with special safety precautions and requirements. No one has an fixed workplace in this room. We use the photos taken by the surveillence camera only if something went wrong (i.e. accident, intrusion or messy laboratory).
Video surveillance is not necessarily illegal, but you do need a very solid legal basis. You should not install a camera in your lab without going through your department's usual processes, likely involving the data protection officer and the Betriebsrat/Personalrat which MUST sign off on such workplace surveillance measures. I don't quite see how a vote among colleagues could authorize this surveillance. Your organization's data protection officer should be able to help you to place the video surveillance on safer footing, or to find better alternatives. Implementing video surveillance could first require a written data protection impact assessment (Datenschutz-Folgeabschätzung). Some pointers below. GDPR/DSGVO compliance starts with three questions: What is the purpose for which personal data is being processed? What is the legal basis for this processing? What means can be used to achieve the purpose, collecting the minimal amount of data necessary? You need to think further about the purpose for which surveillance is necessary. In particular, a camera does not prevent accidents and there might be less invasive ways to prevent intrusion (such as locking the door). Cameras are a fairly extreme measure, and are typically only used as a deterrent to crime, e.g. to deter robbers at a bank counter. The legal basis (GDPR Art 6) you choose is quite relevant because consent (opt-in, Einwilligung) is not generally possible in an employment context, and legitimate interest(berechtigtes Interesse) is not available to public authorities. While companies could use a legitimate interest, this interest must be compelling enough to outweigh the rights and freedoms of the affected data subjects even if they object (try to opt-out). In its guidelines to video devices, the EDPB (EDSA) has also mentioned that the legitimate interest must be non-speculative. The mere concern that equipment could be damaged by an anonymous co-worker is not enough, but past incidents could make this interest legitimate – the amount of surveillance must be proportionate to the actual risks. The disgruntled co-worker could escalate by contacting the data protection officer, lodging a complaint with your state's supervisory authority, or by suing your employer. It is not guaranteed that they would succeed, but it doesn't seem like this instance of surveillance is entirely proper. I would deactivate the cameras until you are sure that the camera surveillance is being performed legally.
Article 640 of the Italian Penal Code under the heading &quot;Crimes against property by fraud&quot; begins (via Google Translate): Anyone who, by artifice or deceit, by misleading someone, procures an unfair profit to himself... And the article (cited by the OP in a comment) says the suspect... ...worked in the health sector and had been suspended from his job because he had refused to be vaccinated against COVID-19. The jab is mandatory for all health workers. So, it seems the allegation is that he intended to &quot;profit&quot; by gaining a COVID-19 vaccine certificate and therefore unjust employment after attempting to use the silicone patch to deceive the health worker. Edit following @jkej's comment observing that the alleged unfair profit was never actually procured. The more likely charge - depending on the actual evidence - would seem to fall under Article 56 which begins under the heading Crime Attempted (again via Google Translate): Whoever carries out suitable acts, directed in an unequivocal way to commit a crime, is liable for an attempted crime, if the action is not carried out or the event does not occur.
The statute in question is section 26708 (13)(B): A vehicle equipped with a video event recorder shall have a notice posted in a visible location which states that a passenger's conversation may be recorded. It doesn't require it be visible to all passengers and doesn't make any provision for visually impaired passengers. I am not licenced to practice in California but know of no cases clarifying how "visible" the notice needs to be. I wouldn't suggest trying to hide the notice, though.
The Facebook Pixel analytics solution does not seem to support access or erasure for data subjects. While there are some GDPR compliance features, these focus on collecting consent prior to collecting data. The relationship between the pixel user and Facebook is also murky. For certain kinds of data, Facebook acts as the data processor only, and the user has all the responsibility as the data controller. For other kinds of data, Facebook and the Pixel user are joint controllers, and therefore jointly responsible. This lack of features doesn't necessarily mean that Facebook Pixel is in violation of the GDPR, since the GDPR Right to Erasure only applies under certain circumstances. However, it is really difficult to argue that a website or app that integrates Facebook Pixel would be compliant. It is also rather dubious that Facebook could be compliant themselves, since their pixels will also collect data about persons who are not Facebook members. While these problems are most apparent with the Facebook Pixel since it's explicitly intended for tracking, this problem also applies to any other embeds provided by Facebook, such as like buttons. This was the subject of the Fashion ID case, in which the ECJ determined (in 2019) that the site operator is a joint controller with regards to data collection on the website by the Facebook embed. This effectively means that third party embeds can only be loaded after the website visitor has given consent for sharing data with Facebook. The tracking of non-users by Facebook was seen as especially problematic in Belgium, where Facebook had been banned from collecting such data already in 2015 (which was upheld in 2018). Since this was pre-GDPR, FB is currently litigating whether Belgium can continue enforcing their ban. I expect that Belgium will prevail with their ban. While this has no immediate consequences for Pixel users, this would make it more likely that Pixel users could be sued or fined successfully. From an advertiser perspective, Facebook does have valuable data that make the integration of Facebook Pixel an attractive proposition. However, other analytics solutions are much easier to bring into compliance. This is ultimately a business decision: will the better understanding of your ad spend on Facebook outweigh the risk and effort of integrating the Pixel?
BAD idea It is one thing to upload the phonebook and associated pictures for use of the owner of the phonebook. It isn't a fair use of the phonebook pictures - and you might not have a license anyway, as some people associate photos with numbers that they don't have a license to associate with anyway. But what if instead of a photo of the person, the first photo someone associated with the person is a photo of something like... crack cocaine, a photo of someone in a very compromising situation, just genitals, or some other thing that is just as tasteless or possibly criminal to share? In that case, your company is possibly committing defamation, and in case sharing or possessing of the image itself is illegal, your company is now the actor and liable. Depending on the content of the picture, distribution of pornographic material (possibly even underage material of that sort) could be up that alley just as much as hate speech through symbols, usage of banned symbols (such as swastikas in Gernamy) and many many others.
Intentional sabotage of a TSA computer system is almost certainly a serious crime and would also almost surely give rise to civil liability, although you might avoid both if you warned the TSA that the phone was set up to intentionally break their system, in which case it might be confiscated as contraband. If the product had a "feature" unknown to you and that you had no reasonable reason to know of that caused the harm, you would ultimately have no criminal or civil liability, although the manufacturer might be strictly liable to the TSA under a product liability theory, and you would probably be detained as a witness to figure out what happened. If the product had a "feature" that broke the TSA computer that could be de-activated and that you meant to de-active but carelessly failed to, you would have negligence liability to the government and might or might not have criminal liability (I'm not enough of an expert in the relevant statutes to know). You might be liable for a strict liability Federal Communications Commission offense for having a device that is in violation of their regulations.
I think you are misinterpreting what the article is saying. It's not Germany as a whole that is banning managers contacting employees (and since you are not a manager, this wouldn't affect you anyway), it is the German ministry of Employment banning it for its employees. When it comes to your own workplace, you will need to look at your own contract and see whether you are allowed to work on the weekend without, for example, getting extra money for that work. This is probably not the case for you as a PhD student, but if it is, you would usually need to talk to your employer before doing work on the weekends.
It depends. There is a law, 29 USC Ch. 22, which generally prohibits employers from requiring polygraph tests before or during employment. However, there are exceptions. It only limits private employers, not governments; certain private employers are allowed to require such tests. The exemptions are set out here. They broadly fall into &quot;government security concerns&quot; (defense subcontractors etc.), security firms, and drug companies. The penalties to be visited on violators are spelled out here.