Data Protection in Germany

From GDPRhub
Data Protection in Germany
Data Protection Authority: BfDI (Germany) and 16 State DPAs
National Implementation Law (Original): Bundesdatenschutzgesetz (BDSG)
English Translation of National Implementation Law: English Translation
Official Language(s): German
National Legislation Database(s): Link
English Legislation Database(s): Link
National Decision Database(s): Link



The birthday of data protection law in Germany is 30 September 1970, the date on which the Hessian state parliament[1] passed the Data Protection Act[2]. On a federal level Bundestag and Bundesrat enacted the Bundesdatenschutzgesetz (Federal Data Protection Act).[3] The next step in in data protection law was taken in 1983 by the German Constitutional Court.[4] The Court derived a fundamental right of informational self-determination:

1. In the context of modern data processing, the general right of personality under Article 2.1 in conjunction with Article 1.1 of the Basic Law encompasses the protection of the individual against unlimited collection, storage, use and sharing of personal data. The fundamental right guarantees the authority conferred on the individual to, in principle, decide themselves on the disclosure and use of their personal data.
2. Limitations of this right to “informational self-determination” are only permissible if there is an overriding public interest. They require a statutory basis that must be constitutional itself and comply with the principle of legal clarity under the rule of law. The legislator must furthermore observe the principle of proportionality. It must also put in place organisational and procedural safeguards that counter the risk of violating the general right of personality.
According to the provisions of the Census Law, a census in the form of a total census was to take place in spring 1983. The census was to be carried out door-to-door by civil servants or public administration officials, as a comparison of registers by the authorities was considered too error-prone. In addition to the complete head count, the collection of further information was also intended.

Several constitutional complaints were filed against this federal law. On 12 April 1983, the first hearing was held before the first senate of the Federal Constitutional Court, which on the following day issued a temporary injunction based on applications by the Lüneburg law student Gunther Freiherr von Mirbach and the Hamburg lawyers Maja Stadler-Euler and Gisela Wild, suspending the implementation of the census law until a decision had been made on the constitutional complaints. The Federal Government and all state governments, with the exception of the Senate of the Free and Hanseatic City of Hamburg, considered the Census Act and the project to be constitutional.

The Federal Constitutional Court contradicted this: after further oral hearings on 18 and 19 October 1983, it found in its judgment of 15 December 1983 that numerous provisions of the Census Act encroached significantly and without justification on the fundamental rights of the individual. It declared these provisions null and void and the entire Federal Act unconstitutional, since it violated the complainants' right to informational self-determination. The Federal Constitutional Court derived this right from Article 2.1 of the Basic Law (Grundgesetz - GG), the right to free development of personality, and from Article 1.1 of the Basic Law, the inviolability of human dignity.

National constitutional protections

You can help us fill this section!

National GDPR implementation law

In Germany the GDPR is implemented by the Bundesdatenschutzgesetz (BDSG).

You can help us fill this section!

Age of consent

You can help us fill this section!

Freedom of Speech

You can help us fill this section!

Employment context

You can help us fill this section!


You can help us fill this section!

Other relevant national provisions and laws

You can help us fill this section!

National ePrivacy Law

You can help us fill this section!

Data Protection Authorities

BfDI (Federal DPA)

The German Federal Data Protection Authority (Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit) is the national data protection authority for Germany. It is however only in charge of federal government authorities and private telecoms and postal services. Any other private entity in Germany is regulated by the relevant state DPA.

→ Details see BfDI (Germany)

German State DPAs for the private sector

The following DPAs are in charge of private sector controllers (except telecoms and postal services) in Germany:

Judicial protection

Civil Courts

You can help us fill this section!

Administrative Courts

Appeals against decisions of German DPAs are brought before the district administrative courts (Verwaltungsgericht; e.g. for the Federal DPA in Bonn/North Rhine-Westphalia - the administrative court in Cologne, for the LDI in Düsseldorf (North Rhine-Westphalia) - the administrative court in Düsseldorf). In most cases appeal against the courts decision (Berufung) is possible to the Lands corresponding Higher Administrative Court (Oberverwaltungsgericht [OVG], Verwaltungsgerichtshof [VGH] in Baden-Württemberg, Bavaria and Hesse; Berlin and Bandenburg share one OVG). In some cases appeal against the Higher Administrative Court (Revision) is possible to the Federal Administrative Court (Bundesverwaltungsgericht [BVerfG])- this appeal is also possible in some rare cases if plaintiff and defendant both agree as an appeal to a district court's decision (Sprungrevision).

The German administative courts regularly are described as used to interpreting european law. The European Court of Justice is in high esteem.

Constitutional Court

If no more appeal is possible (Rechtswegerschöpfung) constitutional complaints to the corresponding Constitutional Court of the Land (Verfassungsgericht [VerfG], Landesverfassungsgericht [LVerfG], Verfassungsgerichtshof [VerfGH], Staatsgerichtshof [StGH]) or the Federal Constitutional Court (Bundesverfassungsgericht [BVerfG]) is possible.

The Federal Constitutional Court ruled in 1986 (As-long-as-2-decision)[6]

As long as the European Communities, and in particular the case-law of the Court of Justice of the Communities, generally guarantee effective protection of fundamental rights against the sovereignty of the Communities, which is to be regarded as essentially equivalent to the protection of fundamental rights which the Basic Law requires as indispensable, especially since the essential content of fundamental rights is generally guaranteed, the Federal Constitutional Court will no longer exercise its jurisdiction over the applicability of secondary Community law, which is used as the legal basis for conduct by German courts and authorities in the sovereign territory of the Federal Republic of Germany, and will therefore no longer review this law against the standard of fundamental rights of the Basic Law; corresponding submissions under Article 100 Section 1 of the Basic Law are therefore inadmissible.

and added in 2019 (Right-to-be-forgotten-2-decision)[7]

In accordance with the principle of the primacy of Union law, the application of rules which are fully harmonised in Union law is, as a general rule, governed not by the fundamental rights of the Basic Law but solely by the fundamental rights of the Union. This primacy of application is subject, inter alia, to the proviso that the protection of the respective fundamental right by the fundamental rights of the Union that are applied instead is sufficiently effective..

Since data protection law is fully harmonised in Union law, in most cases brought before German Constitutional Courts the Articles 7 and 8 of the Charter of Fundamental Rights of the European Union might be interpreted before the German fundamental right to Informational self-determination (Article 2 Section 1 in conjunction with Article 1 Section 1 of the Basic Law).

Publication of descisions

The German DPAs regularly do not publish their decisions in full text.

The higher German courts regularly publish their decisions. If a decision by German court is not published, it can be retrieved by post, De-Mail or EGVP. It is possible that a fee of 12,50 EUR is charged.

All Länder and the Federal Courts provide their own descision databases:


  1. Hessischer Landtag. Stenographischer Bericht 6/80 p. 4271f 30. September 1970
  2. Datenschutzgesetz [HE 1970]. GVBl. HE 1970 S. 625
  3. Bundesdatenschutzgesetz. BGBl. I 1977 S. 201
  4. Bundesverfassungsgericht. Judgement of the first senate of 15. Dezember 1983 - 1 BvR 209/83, 1 BvR 269/83, 1 BvR 362/83, 1 BvR 420/83, 1 BvR 440/83, 1 BvR 484/83 (in DE) (Abstract in EN) - ECLI:DE:BVerfG:1983:rs19831215.1bvr020983
  5. Translated: Wikipedia contributors. (28. Oktober 2019, 12:54 UTC). Volkszählungsurteil. In Wikipedia, The Free Encyclopedia. Retrieved 1. April 2020, 20:01 UTC from
  6. Bundeverfassungsgericht, Second Chamber Ruling, Case 2 BvR 197/83 (in DE), 22. October 1986.
  7. Bundesverfassungsgericht, First Chamber Ruling, Case 1 BvR 276/17 (in DE), 6 November 2019. ECLI:DE:BVerfG:2019:rs20191106.1bvr027617