Moreover, the GDPR is not applicable on police and judicial cooperation in criminal
matters and data processing by EU entities. The BDSG (in the new as well as in the
old version) distinguishes between data processing by federal public bodies and data
processing by private bodies and public-law enterprises participating in competition,
but usually does not apply to regional public bodies. Data processing by regional
(state) public bodies is as a rule regulated on the state level by state data
protection law.
1.3 German Supervisory Authorities for Data Protection
Member States of the European Union shall provide for one (or more) independent
public supervisory authority responsible for monitoring the GDPR in order to protect
the fundamental rights and freedoms of natural persons in relation to data processing,
Art. 51 para. 1 GDPR. The Federal Commissioner for Data Protection and Freedom
of Information monitors data processing by public entities of the federal government,
also by such participating in competition, de jure under old legislation (old BDSG)
and the new Act (new BDSG). The Federal Commissioner is an independent
supreme federal authority.
20 Regional public entities and non-public entities are
monitored by state representatives.
21
Moreover, data processing by private entities is controlled by consumer associations that can file a move for an injunction in case of data protection violations in
(unfair) terms and conditions,
22 if data is illegally used for commercial purposes
23 or
in case of violations of unfair competition law.
24 Additionally, data processing is de
facto monitored by new Watchdog institutions, the so-called Marktwächter, mainly
financed by the government and mainly ran by the most important consumer
associations, which can inform the general public and the state representatives for
data protection in case of data protection shortcomings.
25 Within enterprises, internal
data protection officers are usually established to monitor all aspects of data
processing. Also, works councils exert influence on the data processing of
employees through their right to codetermination.
20 Sec. 22–26 old BDSG, Sec. 8–16 new BDSG.
21 Sec. 38 old BDSG, Sec. 40 new BDSG.
22 Sec. 1 Injunctions Act (UKlaG).
23 Sec. 2 para. 2 no. 11 UKlaG.
24 Sec. 3a Unfair Competition Act (UWG).
25 The exact legal status of these Marktwächter institutions is under discussion.
186
C. Breunig and M. Schmidt-Kessel
matters and data processing by EU entities. The BDSG (in the new as well as in the
old version) distinguishes between data processing by federal public bodies and data
processing by private bodies and public-law enterprises participating in competition,
but usually does not apply to regional public bodies. Data processing by regional
(state) public bodies is as a rule regulated on the state level by state data
protection law.
1.3 German Supervisory Authorities for Data Protection
Member States of the European Union shall provide for one (or more) independent
public supervisory authority responsible for monitoring the GDPR in order to protect
the fundamental rights and freedoms of natural persons in relation to data processing,
Art. 51 para. 1 GDPR. The Federal Commissioner for Data Protection and Freedom
of Information monitors data processing by public entities of the federal government,
also by such participating in competition, de jure under old legislation (old BDSG)
and the new Act (new BDSG). The Federal Commissioner is an independent
supreme federal authority.
20 Regional public entities and non-public entities are
monitored by state representatives.
21
Moreover, data processing by private entities is controlled by consumer associations that can file a move for an injunction in case of data protection violations in
(unfair) terms and conditions,
22 if data is illegally used for commercial purposes
23 or
in case of violations of unfair competition law.
24 Additionally, data processing is de
facto monitored by new Watchdog institutions, the so-called Marktwächter, mainly
financed by the government and mainly ran by the most important consumer
associations, which can inform the general public and the state representatives for
data protection in case of data protection shortcomings.
25 Within enterprises, internal
data protection officers are usually established to monitor all aspects of data
processing. Also, works councils exert influence on the data processing of
employees through their right to codetermination.
20 Sec. 22–26 old BDSG, Sec. 8–16 new BDSG.
21 Sec. 38 old BDSG, Sec. 40 new BDSG.
22 Sec. 1 Injunctions Act (UKlaG).
23 Sec. 2 para. 2 no. 11 UKlaG.
24 Sec. 3a Unfair Competition Act (UWG).
25 The exact legal status of these Marktwächter institutions is under discussion.
186
C. Breunig and M. Schmidt-Kessel