CJEU, Judgment of 11 December 2019, C-708/18, Asociaţia de Proprietari
Video surveillance in an apartment building; three-stage test in the balancing of interests and restrictive interpretation of necessity.
1 Overview
The case concerned video surveillance in the common areas of a Romanian apartment building. The Court gives more precise shape to the examination of the lawfulness of processing under Article 7(f) of the Data Protection Directive (today Article 6(1)(f) GDPR).
Reference: CJEU, judgment of 11 December 2019, C-708/18, TK/Asociaţia de Proprietari bloc M5A-ScaraA
2 Three-stage test
The Court confirms the three-stage test:
- the existence of a legitimate interest,
- the necessity of the processing in order to achieve that interest,
- whether the fundamental rights and interests of the data subject override that interest.
3 Necessity and data minimization
As regards the criterion of necessity, the Court emphasizes that the processing must remain limited to what is strictly necessary. It must be examined whether the legitimate interest can also be safeguarded by less intrusive means, for example by access control, by video surveillance of limited areas or by other security measures. The decision is formative for the assessment of video surveillance carried out by private parties under the GDPR.
About the author
About the author
This article was written by Dr. Thomas Helbing, specialist lawyer for IT law in Munich.
Since 2020 and continuously through today (2026), Handelsblatt has recognized Dr. Helbing as one of "Germany's Best Lawyers" in IT law and data protection law.
According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the leading lawyers for data protection and IT law and is listed among the top 100 lawyers in Germany (2024/25). Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.
His professional background covers the full spectrum of IT and technology law practice. He began his career at a major international law firm, then gained in-house experience at a DAX-listed company, and is himself an entrepreneur and founder of several digital ventures. He also has hands-on programming experience, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.
For many years, his clients have included technology companies and SaaS providers, leading German research institutions and a systemically important German bank. His advisory focus lies in particular on GDPR compliance, the data economy, SaaS, AI regulation and IT contract law.
CJEU, Judgment of 1 October 2019, C-673/17, Planet49
Requirements for valid consent in the online context: active conduct, no pre-ticked boxes, clear information about cookies.
CJEU, Judgment of 4 May 2017, C-13/16, Rīgas satiksme
Interpretation of the balancing-of-interests clause in Article 7(f) of the Data Protection Directive; three-stage test and the standard of necessity.