Data Protection in Germany

From GDPRhub
Data Protection in Germany
Data Protection Authority: BfDI (Germany) and 17 State DPAs
National Implementation Law (Original): Bundesdatenschutzgesetz (BDSG)
English Translation of National Implementation Law: English Translation
Official Language(s): German
National Legislation Database(s): Link
English Legislation Database(s): Link
National Decision Database(s): Link



The birthday of data protection law in Germany is 30 September 1970, the date on which the Hessian state parliament[1] passed the Data Protection Act[2]. On a federal level Bundestag and Bundesrat enacted the Bundesdatenschutzgesetz (Federal Data Protection Act).[3] The next step in in data protection law was taken in 1983 by the German Constitutional Court.[4] The Court derived a fundamental right of informational self-determination:

1. In the context of modern data processing, the general right of personality under Article 2.1 in conjunction with Article 1.1 of the Basic Law encompasses the protection of the individual against unlimited collection, storage, use and sharing of personal data. The fundamental right guarantees the authority conferred on the individual to, in principle, decide themselves on the disclosure and use of their personal data.
2. Limitations of this right to “informational self-determination” are only permissible if there is an overriding public interest. They require a statutory basis that must be constitutional itself and comply with the principle of legal clarity under the rule of law. The legislator must furthermore observe the principle of proportionality. It must also put in place organisational and procedural safeguards that counter the risk of violating the general right of personality.

According to the provisions of the Census Law, a census in the form of a total census was to take place in spring 1983. The census was to be carried out door-to-door by civil servants or public administration officials, as a comparison of registers by the authorities was considered too error-prone. In addition to the complete head count, the collection of further information was also intended. Several constitutional complaints were filed against this federal law. On 12 April 1983, the first hearing was held before the first senate of the Federal Constitutional Court, which on the following day issued a temporary injunction based on applications by the Lüneburg law student Gunther Freiherr von Mirbach and the Hamburg lawyers Maja Stadler-Euler and Gisela Wild, suspending the implementation of the census law until a decision had been made on the constitutional complaints. The Federal Government and all state governments, with the exception of the Senate of the Free and Hanseatic City of Hamburg, considered the Census Act and the project to be constitutional.

The Federal Constitutional Court contradicted this: after further oral hearings on 18 and 19 October 1983, it found in its judgment of 15 December 1983 that numerous provisions of the Census Act encroached significantly and without justification on the fundamental rights of the individual. It declared these provisions null and void and the entire Federal Act unconstitutional, since it violated the complainants' right to informational self-determination. The Federal Constitutional Court derived this right from Article 2.1 of the Basic Law (Grundgesetz - GG), the right to free development of personality, and from Article 1.1 of the Basic Law, the inviolability of human dignity.

National constitutional protections

You can help us fill this section!

National GDPR implementation law

In Germany the GDPR is implemented by the Bundesdatenschutzgesetz (BDSG).

You can help us fill this section!

Age of consent

You can help us fill this section!

Freedom of Speech

You can help us fill this section!

Employment context

You can help us fill this section!


You can help us fill this section!

Other relevant national provisions and laws

There seems to be no statute of limitations for fileing complaints in Germany. However, the pursuant to Section 31 (Limitation of prosecution) of the Administrative Offences Act (Gesetz über Ordnungswidrigkeiten, OWiG), administrative offences become become statute-barred:

  • after three years for offences punishable by a fine of €15,000>;
  • after two years for offences punishable by a fine of of €2,500-€15,000;
  • after one year for offences punishable by a fine of €1,000-€2,500;
  • after six months for other administrative offences (<€1,000).

National ePrivacy Law

Since December 2021, Germany implements Article 5(3) ePrivacy directive through the Gesetz zur Regelung des Datenschutzes und des Schutzes der Privatsphäre in der Telekommunikation und bei Telemedien (TTDSG).

In particular, § 25 TTDSG defines privacy protections for terminal equipment and is to be understood as an implementation of Article 5(3) ePD. § 25(1) TTDSG mandates that information (notably also information that is not considered personal data under the GDPR) may only be stored on or accessed from a user's terminal equipment if the user has given consent based on clear and comprehensive information, which is to be provided in accordance with the GDPR. § 25(2) TTDSG then provides two exceptions from that rule, namely if (1) the sole purpose of the storing or access is to carry out the transmission of a communication over a public telecommunications network, or if (2) it is necessary to provide a telemedia service that is explicitly requested by the user. “Terminal equipment” is defined in § 2(2)(6) TTDSG.

Previously, in October 2019, the CJEU had already ruled that § 15(3) TMG (Telemediengesetz) had to be interpreted in line with Article 5(3) ePD, even against the explicit wording of that provision, in its Planet49 ruling. This interpretation was adopted by the German Federal Court of Justice in its June 2020 ruling on the same case.[6]

Data Protection Authorities

BfDI (Federal DPA)

The German Federal Data Protection Authority (Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit) is the national data protection authority for Germany. It is however only in charge of federal government authorities and private telecoms and postal services. Any other private entity and all other authorities in Germany is regulated by the relevant state DPA.

→ Details see BfDI (Germany)

German State DPAs for the private sector

The following DPAs are in charge of all controllers (except federal government authorities and telecoms and postal services) in Germany:

Judicial protection

Civil Courts

You can help us fill this section!

Administrative Courts

Appeals against decisions of German DPAs are brought before the district administrative courts (Verwaltungsgericht; e.g. for the Federal DPA in Bonn/North Rhine-Westphalia - the administrative court in Cologne, for the LDI in Düsseldorf (North Rhine-Westphalia) - the administrative court in Düsseldorf). In most cases appeal against the courts decision (Berufung) is possible to the Lands corresponding Higher Administrative Court (Oberverwaltungsgericht [OVG], Verwaltungsgerichtshof [VGH] in Baden-Württemberg, Bavaria and Hesse; Berlin and Bandenburg share one OVG). In some cases appeal against the Higher Administrative Court (Revision) is possible to the Federal Administrative Court (Bundesverwaltungsgericht [BVerwG])- this appeal is also possible in some rare cases if plaintiff and defendant both agree as an appeal to a district court's decision (Sprungrevision).

The German administative courts regularly are described as used to interpreting european law. The European Court of Justice is in high esteem.

Constitutional Court

If no more appeal is possible (Rechtswegerschöpfung) constitutional complaints to the corresponding Constitutional Court of the Land (Verfassungsgericht [VerfG], Landesverfassungsgericht [LVerfG], Verfassungsgerichtshof [VerfGH], Staatsgerichtshof [StGH]) or the Federal Constitutional Court (Bundesverfassungsgericht [BVerfG]) is possible.

The Federal Constitutional Court ruled in 1986 (As-long-as-2-decision)[7]

As long as the European Communities, and in particular the case-law of the Court of Justice of the Communities, generally guarantee effective protection of fundamental rights against the sovereignty of the Communities, which is to be regarded as essentially equivalent to the protection of fundamental rights which the Basic Law requires as indispensable, especially since the essential content of fundamental rights is generally guaranteed, the Federal Constitutional Court will no longer exercise its jurisdiction over the applicability of secondary Community law, which is used as the legal basis for conduct by German courts and authorities in the sovereign territory of the Federal Republic of Germany, and will therefore no longer review this law against the standard of fundamental rights of the Basic Law; corresponding submissions under Article 100 Section 1 of the Basic Law are therefore inadmissible.

Added in 2019 (Right-to-be-forgotten-2-decision)[8]

In accordance with the principle of the primacy of Union law, the application of rules which are fully harmonised in Union law is, as a general rule, governed not by the fundamental rights of the Basic Law but solely by the fundamental rights of the Union. This primacy of application is subject, inter alia, to the proviso that the protection of the respective fundamental right by the fundamental rights of the Union that are applied instead is sufficiently effective..

And again added in 2020 (Public-Sector-Purchase-Programme-decision)[9]

The Court of Justice of the European Union exceeds its judicial mandate, as determined by the functions conferred upon it in Article 19(1) second sentence of the Treaty on European Union, where an interpretation of the Treaties is not comprehensible and must thus be considered arbitrary from an objective perspective. If the Court of Justice of the European Union crosses that limit, its decisions are no longer covered by Article 19(1) second sentence of the Treaty on European Union in conjunction with the domestic Act of Approval; at least in relation to Germany, these decisions lack the minimum of democratic legitimation necessary under Article 23(1) second sentence in conjunction with Article 20(1) and (2) and Article 79(3) of the Basic Law.

Since data protection law is fully harmonised in Union law, in most cases brought before German Constitutional Courts the Articles 7 and 8 of the Charter of Fundamental Rights of the European Union might be interpreted before the German fundamental right to Informational self-determination (Article 2 Section 1 in conjunction with Article 1 Section 1 of the Basic Law).

Publication of descisions

The German DPAs regularly do not publish their decisions in full text.


The higher German courts regularly publish their decisions. If a decision by German court is not published, it can be retrieved by post, De-Mail or EGVP. It is possible that a fee of 12,50 EUR is charged.

All Länder and the Federal Courts provide their own descision databases.

Federal Courts
Court English Name Category DE EN FR ES
Bundesverfassungsgericht Federal Constituional Court BVerfG
Gemeinsamer Senat der obersten Gerichtshöfe des Bundes Joint Senate of the Supreme Courts of the Federation BGH Part of BGH-Decisions
Bundesgerichtshof Federal Court of Justice BGH
Bundesverwaltungsgericht Federal Administrative Court BVerwG
Bundesarbeitsgericht Federal Labour Court BAG
Bundesfinanzhof Federal Finance Court BFH
Bundessozialgericht Federal Social Court BSG
Bundespatentgericht Federal Patent Court BPatG
Truppendienstgericht Nord Northern Military service court no decision database
Truppendienstgericht Süd Southern Military service court no decision database
Länder Courts
Lower Saxony
North Rhine-Westphalia

The Ministery of Justice of North Rhine-Westphalia provides a central database of court decisions:



  1. Hessischer Landtag. Stenographischer Bericht 6/80 p. 4271f 30. September 1970
  2. Datenschutzgesetz [HE 1970]. GVBl. HE 1970 S. 625
  3. Bundesdatenschutzgesetz. BGBl. I 1977 S. 201
  4. Bundesverfassungsgericht. Judgement of the first senate of 15. Dezember 1983 - 1 BvR 209/83, 1 BvR 269/83, 1 BvR 362/83, 1 BvR 420/83, 1 BvR 440/83, 1 BvR 484/83 (in DE) (Abstract in EN) - ECLI:DE:BVerfG:1983:rs19831215.1bvr020983
  5. Translated: Wikipedia contributors. (28. Oktober 2019, 12:54 UTC). Volkszählungsurteil. In Wikipedia, The Free Encyclopedia. Retrieved 1. April 2020, 20:01 UTC from
  7. Bundeverfassungsgericht, Second Chamber Ruling, Case 2 BvR 197/83 (in DE), 22. October 1986.
  8. Bundesverfassungsgericht, First Chamber Ruling, Case 1 BvR 276/17 (in DE), 6 November 2019. ECLI:DE:BVerfG:2019:rs20191106.1bvr027617
  9. Bundesverfassungsgericht, Second Senate Judgment, Case 2 BvR 859/15 (in DE), 5 May 2020. ECLI:DE:BVerfG:2020:rs20200505.2bvr085915