German Federal Data Protection Act

German Federal Data Protection Act
Name	Federal Data Protection Act
Native name	Bundesdatenschutzgesetz
Jurisdiction	Federal Republic of Germany
Enacted by	Bundestag
Date assented	2017
Status	amended

German Federal Data Protection Act

The German Federal Data Protection Act provides the national legal framework for personal data processing in the Federal Republic of Germany and implements provisions of the European Union data protection acquis. It interacts with decisions of the European Court of Justice, directives of the European Commission, and standards set by bodies such as the Council of Europe and the Organisation for Economic Co-operation and Development. The Act balances individual privacy protections recognized by the German Basic Law with obligations arising from digitalization, surveillance debates influenced by events like the Snowden disclosures and jurisprudence following the Schrems II judgment.

History and Legislative Background

The Act builds on earlier codes such as the Federal Data Protection Act (1977) lineage and reforms inspired by EU instruments including the Data Protection Directive 95/46/EC and the General Data Protection Regulation. Legislative processes involved the Bundesrat, the Bundestag, and consultations with the Federal Commissioner for Data Protection and Freedom of Information, parliaments of the German Länder and stakeholders from industry associations like the Bitkom and civil society groups such as Digitalcourage. Major amendments responded to rulings by the Court of Justice of the European Union and to international controversies around programmes run by the National Security Agency and decisions affecting Transatlantic trade.

Scope and Key Definitions

The Act applies to processing of personal data by federal public bodies and private entities within the Federal Republic of Germany, with specific provisions for sectors including health governed by the Federal Ministry of Health and employment overseen by the Federal Ministry of Labour and Social Affairs. Key defined terms mirror the General Data Protection Regulation vocabulary: "personal data", "processing", "controller", "processor", "consent", and "special categories of data", with references to jurisprudence from the European Court of Human Rights and the Bundesverfassungsgericht. Provisions clarify applicability to cross-border processing with links to decisions involving the European Data Protection Board and cases concerning multinational corporations like Facebook, Google, and Microsoft.

Rights of Data Subjects

The Act enumerates data subject rights corresponding to instruments such as the Charter of Fundamental Rights of the European Union: access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, and rights related to automated decision-making. Individuals can exercise rights against public authorities including the Federal Office for Information Security under frameworks influenced by rulings in disputes involving companies like Amazon, Apple, and Twitter. Remedies and judicial review invoke courts such as the Bundesverwaltungsgericht and administrative courts in Bavaria or North Rhine-Westphalia, while non-judicial redress can involve the Federal Commissioner for Data Protection and Freedom of Information and European mechanisms tied to the European Commission.

Obligations of Controllers and Processors

Controllers and processors must implement technical and organizational measures, appoint data protection officers in line with thresholds influenced by standards from the International Organization for Standardization and the European Data Protection Board. Obligations include lawful bases for processing, data protection by design and by default, records of processing activities, and breach notification to supervisory authorities and affected data subjects. Contracts between controllers and processors mirror models used by multinationals like SAP and Siemens and are shaped by guidance from bodies such as the German Association for Data Protection and Data Security and the Federal Ministry of the Interior and Community.

Supervisory Authorities and Enforcement

Enforcement is carried out by independent supervisory authorities at federal and state level, notably the office of the Federal Commissioner for Data Protection and Freedom of Information and the data protection authorities of the Länder such as the Berlin Data Protection Authority and the Bavarian State Office for Data Protection Supervision. Powers include investigations, orders, fines, and coordination through the European Data Protection Board. High-profile enforcement actions have involved entities including Deutsche Telekom, Deutsche Bahn, and international firms operating in Germany, often following complaints from civil society organizations like NOYB.

Relationship to EU Law and International Transfers

The Act is designed to be consistent with the General Data Protection Regulation and to implement EU case law from the Court of Justice of the European Union including landmark judgments such as Schrems II. Cross-border transfers rely on mechanisms like adequacy decisions from the European Commission, standard contractual clauses used by firms like SAP SE and Siemens AG, and transfer impact assessments prompted by controversies involving the United States surveillance practices and agreements such as the now-defunct Privacy Shield. Coordination with international frameworks involves institutions like the Council of Europe and negotiations engaging delegations from the United States Department of Commerce.

Category:Data protection legislation of Germany