- within Wealth Management and Family and Matrimonial topic(s)
Data protection disputes rarely begin with spectacular cyberattacks. More often, they arise from something considerably more ordinary: an employee who fails to implement an objection to direct marketing, a customer record that is used for a purpose outside established procedures, or a camera installed for perfectly understandable security reasons that captures a neighbour, an employee, a visitor or a publicly accessible area.
The Liechtenstein Data Protection Authority, the Datenschutzstelle or “DSS”, has recently drawn renewed attention to precisely these situations, highlighting a judgment of the Court of Justice of the European Union concerning the responsibility of controllers for mistakes committed by their employees and an Austrian Federal Administrative Court decision addressing video surveillance in a residential setting. The DSS expressly considers both decisions relevant to its contemporary advisory and complaints practice, notwithstanding that the underlying judgments date from 2024 and 2025.
For Liechtenstein businesses, employers, financial institutions, trustees, professional service providers and property owners, the underlying message is more significant than the individual cases suggest: GDPR accountability cannot ordinarily be outsourced downwards to the employee who made the mistake, while apparently “private” surveillance does not become private merely because the camera is installed on private property.
1. Employee error is not an automatic defence under the GDPR
The first decision, GP v juris GmbH, Case C-741/21, concerned a customer who had objected to his personal data continuing to be used for direct marketing, but nevertheless received further advertising material. The company sought, among other things, to rely on the possibility that an employee had failed to observe the internal instructions that were already in place.
The CJEU rejected the proposition that such an explanation was, by itself, sufficient to release the controller from liability. Article 82 GDPR establishes a fault-based liability regime, but one in which the controller seeking to rely on the exemption in Article 82(3) must demonstrate that it was not responsible for the event causing the damage. Since employees processing data within their employment ordinarily act under the controller's authority, it remains the controller's task to ensure that its instructions are implemented in practice. An organisation therefore cannot escape liability merely by pointing to an individual member of staff who acted negligently or failed to follow an instruction.
That distinction is important. The judgment does not transform Article 82 GDPR into absolute liability, nor does every infringement automatically create a damages claim. The CJEU confirmed that an affected person must establish an infringement, actual material or non-material damage and a causal relationship between the two. There is no minimum threshold of seriousness for non-material loss, but the breach itself is not the damage. The Court also emphasised that compensation under Article 82 serves a compensatory rather than punitive function.
What changes materially, however, is the evidentiary position of the controller. A written policy saying that an employee should not have done something is not, without more, proof that the organisation bears no responsibility for what occurred.
2. The “rogue employee” defence exists, but its scope is narrow
The DSS draws a particularly useful distinction between an employee who simply performs an assigned task incorrectly and an employee who abandons the employer's purposes altogether and processes data for an independent private or third-party purpose.
According to the DSS analysis, a genuine separation of responsibility can arise where an employee acts entirely outside the activity entrusted to him or her, contrary to clear and effectively implemented organisational and technical safeguards, and uses the data for an independent purpose. In such exceptional circumstances, the employee may cease to act merely as a person operating under the company's authority and may instead become an independent controller for that particular processing activity. The DSS refers, by way of illustration, to cases involving the use of customer information for an employee's own business or the disclosure of a customer's telephone number as a personal favour to somebody else.
The legal difference is substantial. An employee who forgets to remove a customer from a marketing campaign remains within the employer's organisational sphere. An employee who extracts customer data for an entirely private venture may, depending on the circumstances, have crossed the boundary into separate controllership.
Even then, however, the analysis does not end with the employee's motivation. The company remains required to demonstrate that appropriate governance was actually in place. The DSS accordingly stresses the continuing relevance of technical and organisational measures, employee information and training under Article 24 GDPR.
The point also has a specifically Liechtenstein dimension. The DSS draws an analogy with the long-established attribution of conduct by auxiliary persons under § 44 para. 1 of the final title to the Liechtenstein Persons and Companies Act. The domestic private-law doctrine and GDPR liability must, of course, remain analytically distinct, but the underlying policy is familiar: a business cannot generally organise its activities through staff and then treat ordinary staff errors as events wholly external to its own sphere of responsibility.
3. Policies alone are becoming increasingly difficult to defend
From a compliance perspective, the more interesting consequence of the CJEU judgment lies not in damages litigation, but in what a company would need to prove when something goes wrong.
For example, where an organisation receives objections to direct marketing, it should be able to demonstrate not only that a written procedure exists, but also how objections enter the relevant systems, whether suppression lists are technically enforced across different platforms, who is authorised to override restrictions, whether manual exports can circumvent them and how compliance is tested.
The same logic applies to customer data, employee records, banking information, health-related information and other sensitive operational datasets. Access rights should reflect actual functions. Exceptional access should be logged. Instructions should be intelligible and periodically refreshed. Training should be role-specific rather than generic. Incident escalation should work before a supervisory authority asks for the documentation, rather than being reconstructed afterwards.
In short, accountability under the GDPR increasingly means evidence of effective implementation, not evidence that a policy once existed.
4. Private CCTV: the camera may be private, but the processing may not be
The second decision highlighted by the DSS concerned a considerably different setting but illustrates the same structural principle.
In the Austrian proceedings, a camera had been used in a shared underground garage to record a neighbour and her children, with images subsequently communicated to a third person. The Austrian Federal Administrative Court upheld the finding that the processing did not fall within the GDPR's household exemption. Images from which individuals can be identified constitute personal data, and processing that moves beyond genuinely personal or family activity cannot be insulated from data protection law merely because it is undertaken by a private individual.
This issue deserves particular attention in Liechtenstein because the DSS takes a deliberately cautious approach to permanently installed surveillance cameras. Its published guidance states that where surveillance is intended for security, property protection or the preservation of evidence, the purpose itself may take the processing outside the household exemption, including where a fixed camera is directed exclusively at the owner's property. Where a permanently installed camera records a publicly accessible area, the household exemption is in any event unavailable. The DSS nevertheless stresses that individual cases require assessment on their specific facts.
This can produce consequences that property owners sometimes underestimate. A camera directed at a driveway may also capture part of the pavement. A doorbell camera can record delivery personnel or neighbours. A camera in a shared garage can capture other residents. Commercial premises may record customers and employees. Residential and commercial use may overlap within the same property.
Once the GDPR applies, questions of legal basis, proportionality, retention, access, transparency and data-subject rights arise. Moreover, the DSS states that surveillance of publicly accessible areas is subject to a notification requirement under Liechtenstein law, while cameras should not ordinarily encompass streets, pavements, playgrounds or neighbouring private property.
The compliance question is therefore not simply, “Do I own the camera and the building?” It is: why is the recording being made, who can be identified, which areas are captured, what happens to the footage and who might eventually receive it?
5. Employee monitoring creates an additional layer of risk
The two areas discussed by the DSS can also overlap.
Video systems installed in offices, warehouses, shops, hotels, garages, production facilities or other commercial premises can inevitably record employees, contractors and other persons who spend substantial periods within the monitored area. In those circumstances, a security justification does not automatically permit unrestricted monitoring.
Necessity and proportionality become central. Camera positioning, recording times, access rights, retention periods and the availability of less intrusive measures should be examined before installation rather than after a complaint. Audio recording requires separate and particularly careful analysis.
For boards and management, this is therefore not merely a facilities question. It is part of information governance, employment compliance and corporate risk management.
6. The litigation risk should neither be exaggerated nor ignored
One useful aspect of juris is that it clarifies both sides of Article 82 GDPR.
A controller cannot simply place responsibility on an employee, but a claimant also does not receive compensation simply by identifying a GDPR infringement. Actual damage and causation remain necessary. Likewise, the amount of civil compensation is not calculated by borrowing the criteria used for GDPR administrative fines, and the existence of several infringements does not automatically multiply damages.
That distinction is commercially important because GDPR exposure can develop simultaneously on several levels: supervisory proceedings, corrective measures, administrative sanctions, civil claims, employment consequences, contractual disputes and reputational effects may arise from the same factual incident, yet each follows its own legal logic.
7. What Liechtenstein companies should review now
For organisations operating in Liechtenstein, the DSS update provides a useful opportunity to reassess two areas which often remain outside major compliance projects precisely because they appear mundane.
Employee access to personal data should correspond to demonstrable operational need, instructions should be enforceable through systems where technically possible, training and monitoring should be documented, and organisations should be able to reconstruct why a particular person had access to a particular dataset at a particular time. For video surveillance, existing camera fields should be physically checked, rather than assessed only from installation plans, and the legal basis, purpose, signage, retention settings, access controls and any notification requirement should be reconsidered whenever premises or camera positioning change.
These are relatively modest measures compared with the legal and evidentiary difficulty of proving, after an incident, that an organisation bears no responsibility for what happened.
How Bergt Law can assist
Bergt Law advises Liechtenstein and international businesses, financial institutions, fiduciaries, family offices, technology companies and private clients on GDPR and Liechtenstein data protection law, including governance structures, controller and processor arrangements, data breaches, supervisory proceedings and civil disputes.
Sources: Court of Justice of the European Union, Judgment of 11 April 2024, GP v juris GmbH, C-741/21, ECLI:EU:C:2024:288; Austrian Federal Administrative Court, Judgment of 15 September 2025, W258 2242162-1/24E; Datenschutzstelle Liechtenstein, Relevante Rechtsprechung – Update #5 (2026); Datenschutzstelle Liechtenstein, Videoüberwachung im Nachbarschafts- und Wohnbereich; Regulation (EU) 2016/679 (GDPR), in particular Arts. 2, 5, 13, 24, 29 and 82; § 44(1) SchlT PGR.
Key findings
- An employer or other controller cannot ordinarily avoid Article 82 GDPR liability merely by showing that an employee disregarded internal instructions.
- Article 82 remains fault-based, but the controller faces a demanding burden if it seeks complete exoneration.
- A GDPR infringement alone does not establish a damages claim. Actual damage and causation remain necessary.
- An employee acting entirely outside assigned functions for a genuinely independent private purpose may become a separate controller, but this remains an exceptional situation.
- Effective technical controls, access management, documented training and demonstrable implementation are more valuable than policies that exist only on paper.
- A privately owned CCTV system may nevertheless fall within the GDPR, and the DSS takes a restrictive view of the household exemption for fixed security cameras.
- Cameras covering publicly accessible areas or neighbouring property require particular care and may trigger additional Liechtenstein notification and transparency obligations.
- Data protection risk should therefore be treated as an operational governance issue rather than merely as a documentation exercise.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
