factors specific to the physical, physiological, genetic, mental, economic, cultural or
social identity of that natural person”, Art. 4 para. 1 GDPR. The ECJ decided in
Dynamic IP addresses,
16 that dynamic IP addresses are personal data and thus data
protection rules apply on the processing of them.
17
Personal data protection is recognized as a specific fundamental right in Art. 8 of
the EU-Charter of fundamental rights and must be ensured by the EU institutions and
by all Member States of the EU (as far as applying EU law). In Germany, the right to
personal data protection is not explicitly laid down. The Federal Constitutional Court
has derived the right to individual self-determination with respect to information
from Art. 2 para. 1 GG and Art. 1 para. 1 GG in the pioneering census verdict in
1983.
18 Therefore, German law is focusing data protection as a particular personality
right and is not based on a separation between private data in the literal sense of
privacy and public data.
1.2.2 Categories of Personal Data
Personal data is classified in personal data in general, special categories of personal
data and personal data relating to criminal convictions and offences. Special
categories of personal data are “personal data revealing racial or ethnic origin,
political opinions, religious or philosophical beliefs, or trade-union membership,
genetic data, biometric data for the purpose of uniquely identifying a natural person,
data concerning health or data concerning a natural person’s sex life or sexual
orientation”, Art. 9 para. 1 GDPR. On the processing of these particular data stricter
requirements apply.
19
1.2.3 Scope of Application of the Several Instruments on Data
Protection
The GDPR is in general applicable to the processing of personal data by any entity,
also public entities. However, whereas the basic principles are identical for private
and public bodies, the GDPR contains a row of particular rules for public bodies.
16 ECJ, judgment of 19 October 2016—Breyer—C-582/14 ¼ EuZW 2016, 909.
17 The decision was followed by the German Federal Supreme Court für Civil Law and Criminal
Law, the Bundesgerichtshof (BGH), in BGH, judgment of 16 May 2017, VI ZR 135/13 ¼ NJW
2017, 2416.
18 BVerfG, judgment of 15 December 1983—Volkszählungsurteil—BVerfGE 65, 1 ¼ NJW 1984,
419.
19 The processing of special categories of personal data shall generally be prohibited, Art. 9 para.
1, if no exception applies, Art. 9 para. 2 GDPR. Personal data relating to criminal convictions and
offences shall generally be carried out only under the control of official authority, Art. 10 GDPR.
See for stricter requirements e.g. Art. 22 para. 4, Art. 30 para. 5, Art. 35 para. 3 lit. b), Art. 37 para.
1 lit. c) GDPR.
Data Protection in the Internet: National Report Germany
185
social identity of that natural person”, Art. 4 para. 1 GDPR. The ECJ decided in
Dynamic IP addresses,
16 that dynamic IP addresses are personal data and thus data
protection rules apply on the processing of them.
17
Personal data protection is recognized as a specific fundamental right in Art. 8 of
the EU-Charter of fundamental rights and must be ensured by the EU institutions and
by all Member States of the EU (as far as applying EU law). In Germany, the right to
personal data protection is not explicitly laid down. The Federal Constitutional Court
has derived the right to individual self-determination with respect to information
from Art. 2 para. 1 GG and Art. 1 para. 1 GG in the pioneering census verdict in
1983.
18 Therefore, German law is focusing data protection as a particular personality
right and is not based on a separation between private data in the literal sense of
privacy and public data.
1.2.2 Categories of Personal Data
Personal data is classified in personal data in general, special categories of personal
data and personal data relating to criminal convictions and offences. Special
categories of personal data are “personal data revealing racial or ethnic origin,
political opinions, religious or philosophical beliefs, or trade-union membership,
genetic data, biometric data for the purpose of uniquely identifying a natural person,
data concerning health or data concerning a natural person’s sex life or sexual
orientation”, Art. 9 para. 1 GDPR. On the processing of these particular data stricter
requirements apply.
19
1.2.3 Scope of Application of the Several Instruments on Data
Protection
The GDPR is in general applicable to the processing of personal data by any entity,
also public entities. However, whereas the basic principles are identical for private
and public bodies, the GDPR contains a row of particular rules for public bodies.
16 ECJ, judgment of 19 October 2016—Breyer—C-582/14 ¼ EuZW 2016, 909.
17 The decision was followed by the German Federal Supreme Court für Civil Law and Criminal
Law, the Bundesgerichtshof (BGH), in BGH, judgment of 16 May 2017, VI ZR 135/13 ¼ NJW
2017, 2416.
18 BVerfG, judgment of 15 December 1983—Volkszählungsurteil—BVerfGE 65, 1 ¼ NJW 1984,
419.
19 The processing of special categories of personal data shall generally be prohibited, Art. 9 para.
1, if no exception applies, Art. 9 para. 2 GDPR. Personal data relating to criminal convictions and
offences shall generally be carried out only under the control of official authority, Art. 10 GDPR.
See for stricter requirements e.g. Art. 22 para. 4, Art. 30 para. 5, Art. 35 para. 3 lit. b), Art. 37 para.
1 lit. c) GDPR.
Data Protection in the Internet: National Report Germany
185