Data Protection in Germany

Data Protection in Germany
Data Protection Authority:	BfDI (Germany) and 17 State DPAs
National Implementation Law (Original):	Bundesdatenschutzgesetz (BDSG)
English Translation of National Implementation Law:	English Translation
Official Language(s):	German
National Legislation Database(s):	Link
English Legislation Database(s):	Link
National Decision Database(s):	Link

Legislation

History

The birthday of data protection law in Germany is 30 September 1970, the date on which the Hessian state parliament passed the Data Protection Act. On a federal level Bundestag and Bundesrat enacted the Bundesdatenschutzgesetz (Federal Data Protection Act). The next step in in data protection law was taken in 1983 by the German Constitutional Court. The Court derived a fundamental right of informational self-determination:

1. In the context of modern data processing, the general right of personality under Article 2.1 in conjunction with Article 1.1 of the Basic Law encompasses the protection of the individual against unlimited collection, storage, use and sharing of personal data. The fundamental right guarantees the authority conferred on the individual to, in principle, decide themselves on the disclosure and use of their personal data.
2. Limitations of this right to “informational self-determination” are only permissible if there is an overriding public interest. They require a statutory basis that must be constitutional itself and comply with the principle of legal clarity under the rule of law. The legislator must furthermore observe the principle of proportionality. It must also put in place organisational and procedural safeguards that counter the risk of violating the general right of personality.

Context

According to the provisions of the Census Law, a census in the form of a total census was to take place in spring 1983. The census was to be carried out door-to-door by civil servants or public administration officials, as a comparison of registers by the authorities was considered too error-prone. In addition to the complete head count, the collection of further information was also intended. Several constitutional complaints were filed against this federal law. On 12 April 1983, the first hearing was held before the first senate of the Federal Constitutional Court, which on the following day issued a temporary injunction based on applications by the Lüneburg law student Gunther Freiherr von Mirbach and the Hamburg lawyers Maja Stadler-Euler and Gisela Wild, suspending the implementation of the census law until a decision had been made on the constitutional complaints. The Federal Government and all state governments, with the exception of the Senate of the Free and Hanseatic City of Hamburg, considered the Census Act and the project to be constitutional.

The Federal Constitutional Court contradicted this: after further oral hearings on 18 and 19 October 1983, it found in its judgment of 15 December 1983 that numerous provisions of the Census Act encroached significantly and without justification on the fundamental rights of the individual. It declared these provisions null and void and the entire Federal Act unconstitutional, since it violated the complainants' right to informational self-determination. The Federal Constitutional Court derived this right from Article 2.1 of the Basic Law (Grundgesetz - GG), the right to free development of personality, and from Article 1.1 of the Basic Law, the inviolability of human dignity.

National constitutional protections

You can help us fill this section!

National GDPR implementation law

In Germany the GDPR is implemented by the Bundesdatenschutzgesetz (BDSG).

You can help us fill this section!

Age of consent

You can help us fill this section!

Freedom of Speech

You can help us fill this section!

Employment context

You can help us fill this section!

Research

You can help us fill this section!

Other relevant national provisions and laws

You can help us fill this section!

National ePrivacy Law

You can help us fill this section!

Data Protection Authorities

BfDI (Federal DPA)

The German Federal Data Protection Authority (Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit) is the national data protection authority for Germany. It is however only in charge of federal government authorities and private telecoms and postal services. Any other private entity and all other authorities in Germany is regulated by the relevant state DPA.

→ Details see BfDI (Germany)

German State DPAs for the private sector

The following DPAs are in charge of all controllers (except federal government authorities and telecoms and postal services) in Germany:

• LDA (Brandenburg)
• BlnBDI (Berlin)
• LfDI (Baden-Württemberg)
• BayLDA (Bavaria, private sector)
• BayLfD (Bavaria, public sector)
• LfDI (Bremen)
• HBDI (Hesse)
• HmbBfDI (Hamburg)
• LDSB (Mecklenburg-Vorpommern)
• LfDI (Lower Saxony)
• LDI (North Rhine-Westphalia)
• LFDI (Rhineland-Palatinate)
• ULD (Schleswig-Holstein)
• Datenschutzzentrum (Saarland)
• DSB (Saxony)
• LfD (Saxony-Anhalt)
• TLfDI (Thuringia)

Judicial protection

Civil Courts

You can help us fill this section!

Administrative Courts

Appeals against decisions of German DPAs are brought before the district administrative courts (Verwaltungsgericht; e.g. for the Federal DPA in Bonn/North Rhine-Westphalia - the administrative court in Cologne, for the LDI in Düsseldorf (North Rhine-Westphalia) - the administrative court in Düsseldorf). In most cases appeal against the courts decision (Berufung) is possible to the Lands corresponding Higher Administrative Court (Oberverwaltungsgericht [OVG], Verwaltungsgerichtshof [VGH] in Baden-Württemberg, Bavaria and Hesse; Berlin and Bandenburg share one OVG). In some cases appeal against the Higher Administrative Court (Revision) is possible to the Federal Administrative Court (Bundesverwaltungsgericht [BVerwG])- this appeal is also possible in some rare cases if plaintiff and defendant both agree as an appeal to a district court's decision (Sprungrevision).

The German administative courts regularly are described as used to interpreting european law. The European Court of Justice is in high esteem.

Constitutional Court

If no more appeal is possible (Rechtswegerschöpfung) constitutional complaints to the corresponding Constitutional Court of the Land (Verfassungsgericht [VerfG], Landesverfassungsgericht [LVerfG], Verfassungsgerichtshof [VerfGH], Staatsgerichtshof [StGH]) or the Federal Constitutional Court (Bundesverfassungsgericht [BVerfG]) is possible.

The Federal Constitutional Court ruled in 1986 (As-long-as-2-decision)

As long as the European Communities, and in particular the case-law of the Court of Justice of the Communities, generally guarantee effective protection of fundamental rights against the sovereignty of the Communities, which is to be regarded as essentially equivalent to the protection of fundamental rights which the Basic Law requires as indispensable, especially since the essential content of fundamental rights is generally guaranteed, the Federal Constitutional Court will no longer exercise its jurisdiction over the applicability of secondary Community law, which is used as the legal basis for conduct by German courts and authorities in the sovereign territory of the Federal Republic of Germany, and will therefore no longer review this law against the standard of fundamental rights of the Basic Law; corresponding submissions under Article 100 Section 1 of the Basic Law are therefore inadmissible.

Added in 2019 (Right-to-be-forgotten-2-decision)

In accordance with the principle of the primacy of Union law, the application of rules which are fully harmonised in Union law is, as a general rule, governed not by the fundamental rights of the Basic Law but solely by the fundamental rights of the Union. This primacy of application is subject, inter alia, to the proviso that the protection of the respective fundamental right by the fundamental rights of the Union that are applied instead is sufficiently effective..

And again added in 2020 (Public-Sector-Purchase-Programme-decision)

The Court of Justice of the European Union exceeds its judicial mandate, as determined by the functions conferred upon it in Article 19(1) second sentence of the Treaty on European Union, where an interpretation of the Treaties is not comprehensible and must thus be considered arbitrary from an objective perspective. If the Court of Justice of the European Union crosses that limit, its decisions are no longer covered by Article 19(1) second sentence of the Treaty on European Union in conjunction with the domestic Act of Approval; at least in relation to Germany, these decisions lack the minimum of democratic legitimation necessary under Article 23(1) second sentence in conjunction with Article 20(1) and (2) and Article 79(3) of the Basic Law.

Since data protection law is fully harmonised in Union law, in most cases brought before German Constitutional Courts the Articles 7 and 8 of the Charter of Fundamental Rights of the European Union might be interpreted before the German fundamental right to Informational self-determination (Article 2 Section 1 in conjunction with Article 1 Section 1 of the Basic Law).

Publication of descisions

The German DPAs regularly do not publish their decisions in full text.

Courts

The higher German courts regularly publish their decisions. If a decision by German court is not published, it can be retrieved by post, De-Mail or EGVP. It is possible that a fee of 12,50 EUR is charged.

All Länder and the Federal Courts provide their own descision databases.

Länder Courts

North Rhine-Westphalia

The Ministery of Justice of North Rhine-Westphalia provides a central database of court decisions: https://nrwe.de