outdated Data Protection Directive
6 from 1995 and shall apply from 25 May 2018.
7
It is directly applicable in all Member States and guarantees a wide range of rights of
the persons affected.
8 Member states may provide for more specific rules in respect
of specific processing situations such as the involvement of minors, in the employment sector and in context with the right of freedom of expression and information.
9
Besides, the EU data protection framework contains specific rules for data
processing in the communication sector,
10 by prosecution authorities
11 and by EU
entities.
12 All provisions have to be interpreted in light of the fundamental right to
protection of personal data.
German legislation implements the EU standards. The former version Federal
Data Protection Act (“old BDSG”)
13 contained general aspects and basic principles
of data processing while there was (and still is) specific legislation especially in the
telemedia, communications and public sector.
14 Because the GDPR will largely
invalidate the provisions of the old BDSG from the date of its application, an entirely
new act, the “new BDSG”, making use of the opening clauses was established in
summer 2017.
15 Alongside, each region (federal state) has its own regional data
protection act. They are, however, not introducing any new standards and mainly
apply to public institutions and organize the regional data protection authorities.
This national report is written on the basis of the GDPR considering German
particularities.
1.2 Basic Notions
1.2.1 Notion of Personal Data and General Perspective of Protection
Personal data is defined as “any information relating to an identified or identifiable
natural person (‘data subject’); an identifiable natural person is one who can be
identified, directly or indirectly, in particular by reference to an identifier such as a
name, an identification number, location data, an online identifier or to one or more
6 Directive 95/46/EC.
7 Art. 99 para. 2 GDPR.
8 Art. 99 para. 2 GDPR; cf. Art. 288 para. 2 Treaty on the Functioning of the European Union
(TFEU).
9 Art. 8 para. 2, Art. 85 et seq. GDPR.
10 ePrivacy directive 2002/58/EC, adapted by directive 2009/136/EC; new proposal: ePrivacy
regulation COM(2017) 10 final, is discussed.
11 Framework decision 2008/977/JI; replaced by directive 2016/680.
12 Regulation (EC) No. 45/2001; new proposal, COM(2017) 8 final is discussed.
13 Bundesdatenschutzgesetz.
14 E.g. Telemedia Act (TMG), Telecommunications Act (TKG), tax regulation (AO, EStG) and
regional and federal police regulation Acts (PAG, BPolG).
15 Established by article 1 of the Act of June 30, 2017, Federal Official Journal 2017, I, 2097.
184
C. Breunig and M. Schmidt-Kessel
6 from 1995 and shall apply from 25 May 2018.
7
It is directly applicable in all Member States and guarantees a wide range of rights of
the persons affected.
8 Member states may provide for more specific rules in respect
of specific processing situations such as the involvement of minors, in the employment sector and in context with the right of freedom of expression and information.
9
Besides, the EU data protection framework contains specific rules for data
processing in the communication sector,
10 by prosecution authorities
11 and by EU
entities.
12 All provisions have to be interpreted in light of the fundamental right to
protection of personal data.
German legislation implements the EU standards. The former version Federal
Data Protection Act (“old BDSG”)
13 contained general aspects and basic principles
of data processing while there was (and still is) specific legislation especially in the
telemedia, communications and public sector.
14 Because the GDPR will largely
invalidate the provisions of the old BDSG from the date of its application, an entirely
new act, the “new BDSG”, making use of the opening clauses was established in
summer 2017.
15 Alongside, each region (federal state) has its own regional data
protection act. They are, however, not introducing any new standards and mainly
apply to public institutions and organize the regional data protection authorities.
This national report is written on the basis of the GDPR considering German
particularities.
1.2 Basic Notions
1.2.1 Notion of Personal Data and General Perspective of Protection
Personal data is defined as “any information relating to an identified or identifiable
natural person (‘data subject’); an identifiable natural person is one who can be
identified, directly or indirectly, in particular by reference to an identifier such as a
name, an identification number, location data, an online identifier or to one or more
6 Directive 95/46/EC.
7 Art. 99 para. 2 GDPR.
8 Art. 99 para. 2 GDPR; cf. Art. 288 para. 2 Treaty on the Functioning of the European Union
(TFEU).
9 Art. 8 para. 2, Art. 85 et seq. GDPR.
10 ePrivacy directive 2002/58/EC, adapted by directive 2009/136/EC; new proposal: ePrivacy
regulation COM(2017) 10 final, is discussed.
11 Framework decision 2008/977/JI; replaced by directive 2016/680.
12 Regulation (EC) No. 45/2001; new proposal, COM(2017) 8 final is discussed.
13 Bundesdatenschutzgesetz.
14 E.g. Telemedia Act (TMG), Telecommunications Act (TKG), tax regulation (AO, EStG) and
regional and federal police regulation Acts (PAG, BPolG).
15 Established by article 1 of the Act of June 30, 2017, Federal Official Journal 2017, I, 2097.
184
C. Breunig and M. Schmidt-Kessel