LOBBY
security· 10 min read

GDPR and Meeting Room Booking Data: What Your Display Is Allowed to Show

Meeting subjects and organiser names on a door display are personal data. Here is the lawful basis question, how data minimisation applies to a screen in a corridor, the Exchange settings that strip it at source, and the works council problem people hit in Germany and the Netherlands.

A candidate is sitting in your reception waiting for an interview. On the wall is a room overview board showing every meeting room in the building. One of the entries reads "Performance review: Anna Berg" and another reads "Restructuring, legal counsel". Neither of those was meant for a stranger in the lobby, and nobody decided to publish them. The display just showed what the calendar contained.

That is the entire problem in one scene. This post covers what a meeting room display actually processes under the GDPR, which lawful basis usually applies and how to document it, how data minimisation translates into a concrete decision about what appears on a screen in a corridor, the Exchange and Google settings that strip sensitive fields at source, retention of booking history, why sensors and cameras are a different risk category, processor and hosting questions, and the works council step that catches people out in Germany and the Netherlands.

This is general information, not legal advice. We are a Danish company that builds room displays, not a law firm. Confirm anything here with your own DPO or counsel before you rely on it, and check the current text of any guidance cited, because it changes.

Yes, it is personal data

Article 4(1) GDPR defines personal data as any information relating to an identified or identifiable natural person. A meeting entry with an organiser name attached is squarely inside that. So is a subject line that names an individual ("1:1 with Marek"), and so is a subject that reveals something about an identifiable person even indirectly ("Anna, occupational health follow-up").

Two implications people miss:

  1. Displaying it publicly is processing. Disclosure by transmission or otherwise making available is explicitly listed as processing in Article 4(2). Putting a name on a screen in a corridor is a processing operation you have to be able to justify.
  2. Some subject lines are special category data. "Occupational health", "union representation meeting", "religious accommodation request" can reveal health data, trade union membership or religious belief, which fall under Article 9 and need a much stronger basis. You do not want to be relying on a colleague's discretion in a free-text field for your Article 9 compliance.

What lawful basis, and how to document it

In an employment context, consent is usually the wrong answer. The imbalance of power between employer and employee makes freely given consent hard to establish, and consent that can be withdrawn at any time is a poor foundation for something that has to work for every room every day.

The realistic basis for a room display is Article 6(1)(f), legitimate interests. The EDPB's Guidelines 1/2024 on Article 6(1)(f) set out the three-step test you have to be able to show you performed:

  1. Identify the legitimate interest. For a room display that is straightforward: efficient use of shared workspace, avoiding meeting interruptions, reducing double bookings. Real, lawful, and related to your actual activities.
  2. Necessity. Is the processing necessary for that interest, and is there a less intrusive way to achieve it? This is where the subject line usually fails. You do not need the subject to prevent people walking into occupied rooms. You need busy or free, and a time.
  3. The balancing test. Weigh your interest against the rights and reasonable expectations of the data subjects. An employee reasonably expects colleagues to see they have booked a room. They do not reasonably expect a visitor in reception to read the subject of their meeting.

Write the balancing test down. A one page legitimate interests assessment naming the interest, the necessity reasoning, the mitigations you applied and the conclusion is the artefact your DPO will ask for and the artefact a supervisory authority will ask for. It takes an hour.

Data minimisation applied to a door display

Article 5(1)(c) requires personal data to be adequate, relevant and limited to what is necessary for the purpose. On a room display that resolves into a concrete choice between four levels of disclosure:

  • Level 0: free or busy only. "Busy until 11:30." No names, no subjects. Almost no personal data on screen. Solves the walk-in problem completely.
  • Level 1: busy plus organiser name. Useful when people need to know who to ask about a room. Personal data, but minimal and defensible.
  • Level 2: busy plus subject. Higher risk because the subject is free text nobody sanitises.
  • Level 3: subject plus organiser plus attendee list. Hard to justify on a corridor display and easy to argue against.

The practical rule: choose the lowest level that solves your actual problem, and choose it per location. A panel outside a door on a floor only staff can reach is a different exposure than a lobby board a courier can read. Many offices run Level 1 at the doors and Level 0 in reception, and that is a defensible design that costs nothing.

Strip it at the source in Exchange

The strongest control is not a display setting. It is stripping the data before it ever reaches the room's calendar, because then no downstream tool, integration or admin with mailbox access can leak it. Microsoft 365 gives you this through Set-CalendarProcessing.

Connect-ExchangeOnline

# Maximum minimisation: no subject, no body, on the room calendar
Set-CalendarProcessing -Identity "room-copenhagen-3@example.com" `
  -AutomateProcessing AutoAccept `
  -DeleteSubject $true `
  -AddOrganizerToSubject $false `
  -DeleteComments $true `
  -RemovePrivateProperty $false

# Middle ground: subject replaced by the organiser's name
Set-CalendarProcessing -Identity "room-copenhagen-3@example.com" `
  -AutomateProcessing AutoAccept `
  -DeleteSubject $true `
  -AddOrganizerToSubject $true `
  -DeleteComments $true `
  -RemovePrivateProperty $false

Three things worth knowing before you run this:

  • These settings only apply when AutomateProcessing is AutoAccept. On a room mailbox set to manual delegate approval, they do nothing.
  • They apply to incoming requests at the time they are processed. Existing bookings already on the calendar keep whatever they had. If you are cleaning up, you are cleaning up going forward.
  • Someone with read access to the room mailbox can still see more than the display shows. Minimisation on the calendar is not access control on the mailbox. Review who has permissions on your room mailboxes as a separate task.

Private meetings and RemovePrivateProperty

RemovePrivateProperty controls whether the private flag an organiser set on their meeting survives into the room's copy. Set to $true, the flag is cleared and the meeting is no longer private in the room calendar. Set to $false, private meetings stay private.

Set this explicitly to $false rather than relying on the default. When someone marks a meeting private they have made an active decision about their own data, and silently discarding that decision is exactly the kind of thing that turns a minor configuration choice into a complaint.

Google Workspace

Google Workspace does not offer a direct server-side equivalent of DeleteSubject for calendar resources. The resource calendar keeps the event title as the organiser wrote it. That means minimisation for Google shops usually has to happen at the display layer instead, by configuring the display to render busy or free rather than the event title. Check the current options in the Admin console under Buildings and resources before you assume either way, since Google changes this area.

Retention of booking history and analytics

Article 5(1)(e) requires storage limitation. Booking history is where this usually gets forgotten, because analytics dashboards want as much history as possible and nobody defines an end date.

Two clean approaches:

  1. Aggregate early. Keep identifiable booking records for a short operational window (often 30 to 90 days is plenty), then roll them up into per-room, per-hour counts with no organiser attached. Aggregated utilization data is what you actually use for space planning, and it is not personal data once it is genuinely aggregated.
  2. Set a hard retention period and enforce it. If you do keep identifiable history, write down how long and why, and make sure the deletion actually runs. An undocumented "we keep everything" is the position hardest to defend.

Whatever you choose, it goes in your Article 30 record of processing activities alongside the purpose, categories of data and recipients.

Sensors and cameras are a different category

Everything above assumes calendar data. The moment you add occupancy sensing, the risk profile changes.

  • A passive infrared or door contact sensor producing an occupied or not-occupied bit for a room is low risk and often not personal data at all when it cannot be linked to an individual.
  • A headcount sensor becomes personal data quickly if it can be combined with the booking record to establish who was in a room and for how long.
  • A camera in a meeting room, even one that claims to discard frames at the edge, is high risk. Expect to need a data protection impact assessment under Article 35, and expect national DPA guidance on workplace video surveillance to apply.

The design principle from Article 25 (data protection by design and by default) applies directly here: pick the least invasive technology that answers your actual question. If the question is "was the room used", you do not need to know who was in it.

Processors, DPAs and where the data sits

If a display vendor reads your calendar, they are a processor and Article 28 requires a written contract with the mandated terms. Before you sign anything, get answers to:

  • What is actually read? Free/busy only, or full event details including subject and attendees? These are very different data footprints.
  • What is stored, and for how long? A display that renders from a live API call and caches for minutes is a smaller exposure than one that mirrors your calendar into its own database.
  • Where is it hosted? An EU region avoids the international transfer question entirely.
  • Who are the sub-processors? Hosting, monitoring, error tracking and analytics vendors all count, and the list should be published and notified on change.

On transfers: since the European Commission's adequacy decision of 10 July 2023, personal data can flow to US organisations that are certified under the EU-US Data Privacy Framework without additional safeguards. That decision is subject to periodic review and has been legally contested, so if your risk appetite is low, EU hosting removes the dependency rather than managing it.

Works councils in Germany and the Netherlands

This is the step that stops projects, and it is not a GDPR question at all. It is labour law, and it runs in parallel.

Germany. Section 87(1) no. 6 of the Betriebsverfassungsgesetz gives the works council a co-determination right over the introduction and use of technical equipment intended to monitor employee conduct or performance. German Federal Labour Court case law has long read "intended to" broadly: it is enough that the equipment is objectively suitable for monitoring, whether or not you intend to use it that way. A system that records who booked which room when is capable of producing behavioural data about identifiable employees. This is a veto right, not a consultation right. Get the works council in the room early and agree a Betriebsvereinbarung covering what is collected, what it is used for and what it is explicitly not used for.

Netherlands. Article 27(1) of the Wet op de ondernemingsraden gives the ondernemingsraad a consent right (instemmingsrecht) over, among other things, arrangements for processing and protecting employees' personal data (sub k) and arrangements for facilities aimed at or suitable for observing or monitoring attendance, conduct or performance of employees (sub l). Same practical conclusion: talk to them before you order hardware, not after.

In both countries the conversation goes far better when you can say the display shows busy or free with no names, and that booking history is aggregated after 30 days. Minimisation shortens the negotiation, which is a practical benefit sitting on top of the compliance one.

A practical checklist

  1. Decide, per display location, which disclosure level (0 to 3) you need. Default to the lowest.
  2. Write a one page legitimate interests assessment covering purpose, necessity and the balancing test.
  3. Set DeleteSubject, AddOrganizerToSubject, DeleteComments and RemovePrivateProperty explicitly on every room mailbox.
  4. Audit who has read permissions on room mailboxes.
  5. Define a retention period for booking history and an aggregation point after which records stop being identifiable.
  6. Add the display to your Article 30 record and get the Article 28 DPA signed.
  7. Check sub-processors and hosting region. Prefer EU hosting if it is available at no meaningful cost.
  8. If you have a works council, engage before procurement.
  9. If you are adding any sensor that counts or identifies people, run a DPIA under Article 35.
  10. Tell employees what the display shows. Transparency under Articles 13 and 14 is cheap and prevents most complaints.

The buy side of this decision

The disclosure, since this is our blog. Lobby is a meeting room display that syncs with Google Workspace and Microsoft 365 room resources. Relevant to this post: you control what appears on screen, so running busy-or-free with no subject and no organiser is a supported configuration and not a workaround. Full EU hosting for e-ink devices is a Pro Unlimited feature, at USD 60 per month billed yearly (USD 100 per month if you pay month to month), which is the tier most EU customers with a DPO end up on for that reason. There is a Free plan for up to 3 displays, free forever rather than a trial, and an Unlimited plan at USD 30 per month billed yearly (USD 50 per month month to month) for unlimited displays without the EU hosting option.

What Lobby does not do, plainly: no occupancy sensors and no camera data of any kind, which keeps the whole high-risk category off the table. Also no desk booking, no visitor management, no room or AV automation, no enterprise SSO or SCIM at scale, no MDM on the e-ink hardware, and no on-premises Exchange without hybrid. And to be explicit: buying any product, ours included, does not make you compliant. The lawful basis, the assessment, the retention decision and the works council agreement are yours.

TL;DR

  • Meeting subjects and organiser names on a public display are personal data under Article 4(1), and showing them is processing.
  • Consent is a poor basis in an employment context. Legitimate interests under Article 6(1)(f) is the usual answer, and you need a written three-step assessment per EDPB Guidelines 1/2024.
  • Data minimisation resolves into a concrete choice. "Busy until 11:30" solves the walk-in problem with almost no personal data. Pick the lowest level per location.
  • In Exchange, strip at source with DeleteSubject, AddOrganizerToSubject, DeleteComments, and set RemovePrivateProperty to $false so private meetings stay private. These only apply when AutomateProcessing is AutoAccept and only to new requests.
  • Google Workspace has no direct server-side equivalent, so minimise at the display layer.
  • Set a retention period for booking history and aggregate early.
  • Sensors and especially cameras are a much higher risk category and pull in Article 35 DPIAs.
  • Get the Article 28 DPA, check sub-processors, prefer EU hosting to avoid the transfer question.
  • Germany (BetrVG section 87(1) no. 6) and the Netherlands (WOR article 27(1)) give works councils a real veto. Engage before procurement.
  • This is general information, not legal advice. Confirm with your own DPO or counsel.

Related reading

Sources

Legal references and guidance links above were checked on 5 August 2026. Legislation, guidance and adequacy decisions change. Confirm the current position with your own DPO or counsel.

Try Lobby — free forever up to 3 displays

Room booking that just works.

Get started →