2 Data Protection in the Internet
2.1 Personal Data Processed by Electronic Means
2.1.1 Particular Legislation
The GDPR does, as a starting point, apply on the protection of personal data in the
context of services provided at a distance, by electronic means, at the individual
request of a recipient of services. However, it does not contain any specific rules.
More rules that are specific are established by the ePrivacy Directive 2002/58/EC
(“ePD”) which probably will soon be replaced by a new ePrivacy Regulation
(“ePR”).
29
The German Telemedia Act (“TMG”) contains specific rules covering the protection of personal data in the internet sector, which would be applicable to services
provided at a distance, by electronic means, at the individual request of a recipient of
services. These rules also apply to social networks if not communication in itself is
concerned. The rules established by the TMG will most likely to a large extent be
overridden by the GDPR as of May 2018. Art. 95 GDPR, concerning the relation
between the GDPR and national legislation based on the ePD,
30 states that the GDPR
shall not impose additional obligations in relation to processing in relation to matters
which are subject to specific obligations with the same objective set out in the ePD.
Recital 173 GDPR clarifies that national legislation adopted to implement the ePD
shall be given priority of application over contrary rules laid down in the GDPR. It is
therefore essential to distinguish in a very accurate way between national rules, that
have only been adapted to implement the requirements of the ePD and those that
have not been adapted for precisely that reason. In the first case, but not in the
second, national legislation exceptionally prevails; in the second case, the respective
rule will be overridden by the GDPR.
31
The rules of the TMG, in particular the ones relevant for the situation at hand, sec.
11 et seq. TMG, are not based on the ePD. Therefore, they do not fall within the
scope of Art. 95 GDPR. From May 2018, the GDPR prevails over the relevant
provisions of the TMG. If however, the new proposal for an ePR will be adopted,
that regulation will prevail the national rules, which are not replaced by the GDPR
(the rules that have been based on the ePD).
The ePR aims to complement the GDPR and modernize data protection in the
specific field of electronic communications.
32 The GDPR would then be the general
29 See the Proposal by the European Commission for a Regulation concerning the respect for private
life and the protection of personal data in electronic communications and repealing Directive 2002/
58/EC (Regulation on Privacy and Electronic Communications), COM(2017) 10 final.
30 ePrivacy directive 2002/58/EC, adapted by directive 2009/136/EC.
31 For the relation between GDPR and TMG see: Keppeler (2015), pp. 779 et seq.; Nebel and
Richter (2012), pp. 407 et seq.
32 See Schmitz (2017), p. 172 concerning the ePR.
188
C. Breunig and M. Schmidt-Kessel
2.1 Personal Data Processed by Electronic Means
2.1.1 Particular Legislation
The GDPR does, as a starting point, apply on the protection of personal data in the
context of services provided at a distance, by electronic means, at the individual
request of a recipient of services. However, it does not contain any specific rules.
More rules that are specific are established by the ePrivacy Directive 2002/58/EC
(“ePD”) which probably will soon be replaced by a new ePrivacy Regulation
(“ePR”).
29
The German Telemedia Act (“TMG”) contains specific rules covering the protection of personal data in the internet sector, which would be applicable to services
provided at a distance, by electronic means, at the individual request of a recipient of
services. These rules also apply to social networks if not communication in itself is
concerned. The rules established by the TMG will most likely to a large extent be
overridden by the GDPR as of May 2018. Art. 95 GDPR, concerning the relation
between the GDPR and national legislation based on the ePD,
30 states that the GDPR
shall not impose additional obligations in relation to processing in relation to matters
which are subject to specific obligations with the same objective set out in the ePD.
Recital 173 GDPR clarifies that national legislation adopted to implement the ePD
shall be given priority of application over contrary rules laid down in the GDPR. It is
therefore essential to distinguish in a very accurate way between national rules, that
have only been adapted to implement the requirements of the ePD and those that
have not been adapted for precisely that reason. In the first case, but not in the
second, national legislation exceptionally prevails; in the second case, the respective
rule will be overridden by the GDPR.
31
The rules of the TMG, in particular the ones relevant for the situation at hand, sec.
11 et seq. TMG, are not based on the ePD. Therefore, they do not fall within the
scope of Art. 95 GDPR. From May 2018, the GDPR prevails over the relevant
provisions of the TMG. If however, the new proposal for an ePR will be adopted,
that regulation will prevail the national rules, which are not replaced by the GDPR
(the rules that have been based on the ePD).
The ePR aims to complement the GDPR and modernize data protection in the
specific field of electronic communications.
32 The GDPR would then be the general
29 See the Proposal by the European Commission for a Regulation concerning the respect for private
life and the protection of personal data in electronic communications and repealing Directive 2002/
58/EC (Regulation on Privacy and Electronic Communications), COM(2017) 10 final.
30 ePrivacy directive 2002/58/EC, adapted by directive 2009/136/EC.
31 For the relation between GDPR and TMG see: Keppeler (2015), pp. 779 et seq.; Nebel and
Richter (2012), pp. 407 et seq.
32 See Schmitz (2017), p. 172 concerning the ePR.
188
C. Breunig and M. Schmidt-Kessel